- syslog-ng - lists.balabit.hu

does syslog-ng conflict with syslogd? how avoid
by seberino＠spawar.navy.mil 22 Jan '03

22 Jan '03

I just installed syslog-ng. If I kill syslogd and start the syslog-ng daemon will it capture messages from apps trying to talk to syslogd transparently??? So to avoid conflicts and compatibility problems I just have to kill syslogd and swap in the new daemon??? That would be great if so.... then if I could get syslog-ng.conf done right I'm in business!! Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2363 49590 Lassing Road, Room A339 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-7940 Fax: (619) 553-1269 Email: seberino(a)spawar.navy.mil _______________________________________

1 0

Where docs for syslog-ng.conf installation and remote logging??
by seberino＠spawar.navy.mil 22 Jan '03

22 Jan '03

I looked thru README and INSTALL files and table of contents for syslog-ng big doc. I cannot find anything on installing the /etc/syslog-ng.conf. I assume one must make their own and just put the file there themselves??? Can I just use my old syslog.conf as is??? Where are docs for setting up secure (ssh) remote logging??? Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2363 49590 Lassing Road, Room A339 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-7940 Fax: (619) 553-1269 Email: seberino(a)spawar.navy.mil _______________________________________

1 0

1.5.24 hangs, Red Hat Linux 7.1 2.96-98
by Greg Hartung 22 Jan '03

22 Jan '03

I upgraded from 1.4.14 to 1.5.24 because I needed support for named pipes. Now the daemon hangs every few hours or so (with or without the use of pipes). All the output files (about 90 devices) have the same last timestamp. It happens a dozen or more times a day with no obvious pattern in the timing. Does seem to be proportional to volume (doesn't hang overnight). The output actually stops mid-message. Many of the files are 2GB or more. kill -HUP or syslog-ng restart seems to clear the problem up (continues writing to the same large files). syslog-ng conf file is about 10k with about 20 filter/log/destination combo's. Any ideas? If you want to see the config, let me know, I just didn't want to clutter the list... Thanks, Greg

3 2

Embarrassing newbie question
by rich coco 22 Jan '03

22 Jan '03

I have installed syslog-ng on two RedHat PCs (7.0 and 8.0). I first stopped syslogd/klogd. ran "syslog-ng -s" to verify that the syntax of my cfg file was ok and then ran syslog-ng. I even ran syslog-ng in debug mode, in the foreground. it spews a bunch of output to stdout as it parses the cfg file (i believe), but then gets silent afterwards...even as I run logger(1). Nothing ever appears in any log file! same result on both systems, so i have to assume it is something silly I am not doing right. Here is my painfully simple cfg file: source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; destination messages { file("/var/log/messages"); }; # Log anything of level debug or higher. filter f_messages { level(debug); }; log { source(src); filter(f_messages); destination(messages); }; i tried testing this by running logger(1), which I understand writes output to /dev/log. Nothing ever appears in /var/log/messages. In fact, no files in /var/log *ever* get written. Well, actually, i am leaving something out...and it is very strange but probably a key clue: when i shutdown syslog-ng and restart syslogd/klogd, I *do* get output in /var/log/messages. A bunch of lines announcing the startup of syslogd/klogd and, at *after* those entries, a single line announcing the shutdown of syslog-ng (the *only* output I *ever* get from syslog-ng): Jan 21 21:08:48 ape syslog: syslogd startup succeeded Jan 21 21:08:48 ape kernel: klogd 1.3-3, log source = /proc/kmsg started. Jan 21 21:08:48 ape kernel: Inspecting /boot/System.map-2.2.19-7.0.1 Jan 21 21:08:48 ape syslog: klogd startup succeeded Jan 21 21:08:48 ape kernel: Loaded 7296 symbols from /boot/System.map-2.2.19-7.0.1. Jan 21 21:08:48 ape kernel: Symbols match kernel version 2.2.19. Jan 21 21:08:48 ape kernel: Loaded 409 symbols from 12 modules. Jan 21 21:08:26 ape syslog-ng: syslog-ng shutdown succeeded Notice that the timestamp of the last line is 22 seconds EARLIER THAN the timestamp of the preceeding line! No doubt 22 seconds passed between the time I stopped syslog-ng and restarted syslogd/klogd. But how/why did the syslog-ng appear *after* the syslogd/klogd startup announcements? Some strange buffering of syslog-ng output? Why isn't syslog-ng monitoring /dev/log as I asked it to? Did I ask it incorrectly? Is it writing output to somewhere I cannot see? HELP! this is making me nuts!!!

2 1

Suggestions/enhancements miscellany
by Ted_Rule＠flextech.co.uk 22 Jan '03

22 Jan '03

Whilst at least some of the following has been mentioned before, I'd like to make a another little plea for some extra features and tidyups to syslog-ng and its associated documentation. a) SIGHUP/keep-listening feature request The current version supports the keepalive stream socket feature for both TCP and Unix-Stream which means that existing connections are kept open across a SIGHUP/reconfig. This is all well and good, and provides sufficient functionality to avoid losing a Stream Source Socket message. However, for UDP sockets, I believe the socket is closed/re-opened on SIGHUP, which thereby has the potential for loss of messages across a SIGHUP. Unix syslog client boxes in general could in theory all be reconfigured to use syslog-ng and hence use TCP, and hence avoid message drops on a central syslog server, but most embedded devices such as Cisco routers, HP printers, etc etc, can only use UDP. Hence the request to provide the "enhanced Frasier" option, as in "I'm still listening" for both types of datagram socket. I would suggest calling this option "keep-listening()". I'm well aware this may be tricky to code, but given the large population of UDP only devices, I would have thought many people would like to see it implemented. I did have a brief attempt to try and follow enough of the code layout to work out how and where it might be glued into place - but this bear of little brain got somewhat too confused to take it further. b) SIGUSR1/logrotate feature. To avoid losing UDP messages, one extra trick might be to include another signal - say SIGUSR1 - which is used merely to close all open destinations. This would be used for log rotation - I'm assuming there would never be a requirement to add open() code to this as well, as any required destination should be simply opened on demand. At present, SIGHUP is used to ensure destination closure for log rotation purposes, but this has the side-effect of closing sources, and hence potentially losing UDP messages. Adding SIGUSR1 would avoid any loss of messages during the overnight rotation, although there is obviously still the potential for message loss during any other required SIGHUP/reconfiguration without the keep-listening() feature. c) --checkconf option Once a new syslog-ng.conf has been built, it may be dangerous to SIGHUP it into life; a simple spelling error or a missed semi-colon could in theory lead to death of the running daemon, I believe. In mimicry of bind9's named-checkconf utility, can we have an extra command-line option to syslog-ng which merely checks for all potential syntactical errors in syslog-ng.conf returning non-zero error code and messaging stderr with any syntax errors thus found. I suggest "--checkconf" for the command line option name. Using this, a general init script wrapper might contain: syslog-ng.conf --checkconf && kill -HUP `cat /var/run/syslog-ng.pid` to avoid sending a signal if the configuration check fails. This option is also probably dependent on making the SIGUSR1 option available, elsewise a broken configuration file may lead to loss of log rotation. d) Default options settings documentation. This page in the current copy of the documentation: http://www.balabit.hu/static/syslog-ng/reference/x564.html would benefit greatly from a rewrite showing the default setting as an extra column for each option. Some options have their defaults listed here, but most do not. e) Working examples of regex usage. There are very few of the example configurations I have seen which show specific examples of the regex matching capabilities of the filter() functions. If anyone has some samples perhaps some more examples could be added to either the FAQ or the Documentation or both, please? Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

2 1

File descriptor still opened after log rotation
by Xavier de Labouret 22 Jan '03

22 Jan '03

>> I have a strange behaviour with syslog-ng 1.4.16 and rotated files. It >> looks like syslog-ng keeps file descriptors opened, despite the time_reap >> parameter, in a file where very few logs are sent. This generates >> problems with log rotations. > > time_reap() is only used when a filename with macros in it is used. e.g. [Sorry for breaking the thread, i had not subscribed to the list before posting in it] Thank you for this quick answer, for i had no clue with this problem. Here are my questions: 1) Is this by design? I did not find this restriction it in the docs. In this case, it would be of great help to write explicitely in the docs that time_reap applies only to macro-generated file destinations. I can get a turnaround for this by using $FACILITY, which won't change during execution for this destination. 2) Is it planned to stay so? I am inclined to think that this feature would be helpful for any file destination, to prevent conflicts with rotations. Do you intend to extend the time_reap feature to any file destination? Regards, Xavier de Labouret

2 1

File descriptor still opened after log rotation
by Xavier de Labouret 21 Jan '03

21 Jan '03

Hello, I have a strange behaviour with syslog-ng 1.4.16 and rotated files. It looks like syslog-ng keeps file descriptors opened, despite the time_reap parameter, in a file where very few logs are sent. This generates problems with log rotations. Here is my syslog-ng.conf (extract). --------------8<---------------- options { long_hostnames(off); sync(0); owner("root"); group("adm"); perm(0644); time_reap(30); }; source src { unix-stream("/dev/log"); internal(); udp(); }; filter f_heartbeat { facility(local7) and program(heartbeat/syslog-ng); }; destination d_heartbeat { file("/usr2/log/heartbeat.log"); }; log { source(src); filter(f_heartbeat); destination(d_heartbeat); }; -------------->8---------------- Important points are: target file is /usr2/log/heartbeat.log, time_reap is set to 30. My "heartbeat" application is logging every 5 minutes in this file, with the appname "heartbeat/syslog-ng". *This is the only line logged to this destination*. So we have 5 minutes of inactivity between 2 logs. I rotate heartbeat.log every 5 minutes too, 3 minutes after the call to the heartbeat application. I am using savelog for the rotation. My problem: syslog-ng keeps a file descriptor opened on the after the rotation. I don't understand why the time_reap parameter (set to 30) is ignored. Did i miss anything? Thank you in advance for your help, Xavier de Labouret

2 1

Template use to log recieved time?
by Blaise St-Laurent 21 Jan '03

21 Jan '03

Has anyone had any success using the template options to log the recieved time as part of the message? I'd like to do something like: destination d_archive {file("/var/log/archive/$YEAR$MONTH$DAY/$HOST/$FACILITY" template ("$TIME_RCVD : $MSG") ) }; but goign through affile.c, i'm unsure if this is currently possible, or if it will be possible in 1.5.25 (i'm using 24) Anyone used anything similar so far? Blaise St-Laurent Senior Security Architect 613-266-4258 ____________________________________________________________________ Okiok Data http://www.okiok.com (450) 681-1681 Solutions de sécurité d'entreprise et d'affaires électroniques Enterprise and e-business security solutions This e-mail message (including attachments, if any) is intended for the use of the individual or entity to which it is addressed and may contain information that is privileged, proprietary, confidential and exempt from disclosure. If you are not the intended recipient, you are notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender and erase this e-mail message immediately. Le présent message électronique (y compris les pièces qui y sont annexées, le cas échéant) s'adresse au destinataire indiqué et peut contenir des renseignements de caractère privé ou confidentiel. Si vous n'êtes pas le destinataire de ce document, nous vous signalons qu'il est strictement interdit de le diffuser, de le distribuer ou de le reproduire. Si ce message vous a été transmis par erreur, veuillez en informer l'expéditeur et le supprimer immédiatement.

1 0

syslog vs syslog-ng
by Moktar KONE 20 Jan '03

20 Jan '03

hi , I have three machines A B and C which run syslog (not syslog-ng) and they send now their logs toward a remote host S. How is it possible with syslogd (running over S) to manage differents logs from A, B and C according to the log source (i.e create a file for log coming from A , an other file for log coming from B and an other file for C). the machine S, which receive logs is running syslogd , how can it manage the logs coming from the others machines according to their source. If syslog is not able to manage this , can syslog-ng do it?how? thanks

1 0

syslog-ng and logconf
by Systems Administrator 17 Jan '03

17 Jan '03

Hi. I thought I'd write you an e-mail about a package I made called "logconf". It's basically designed to automatically generate configuration for things that interact with logs. At the moment, it only configures syslog-ng, logwatch, and logrotate. I thoguht it might interest. http://sourceforge.net/projects/logconf Thanks, Tim Nelson Systems Administrator Sunet Internet Tel: +61 3 5241 1155 Fax: +61 3 5241 6187 Web: http://www.sunet.com.au/ Email: sysadmin(a)sunet.com.au

1 0

rotate files
by Sergio A Lima Jr. 16 Jan '03

16 Jan '03

Hello all, how to for determine log files rotate in the syslog-ng? Below, this syslog-ng.conf: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source stdlog { unix-stream("/dev/log"); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_iptl { file("/var/log/filtering.log"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or facility(news) and level(crit); }; filter f_filter7 { facility(mail) and not match ("i[pP]op3"); }; filter f_filter8 { facility(mail) and not match ("ipop3d"); }; filter f_filter9 { facility(kern) and match ("Bad packet from localnet"); }; log { source(stdlog); filter(f_filter1); destination(d_cons); }; log { source(stdlog); filter(f_filter2); destination(d_mesg); }; log { source(stdlog); filter(f_filter3); destination(d_auth); }; log { source(stdlog); filter(f_filter4); destination(d_mail); }; log { source(stdlog); filter(f_filter5); destination(d_mlal); }; log { source(stdlog); filter(f_filter6); destination(d_spol); }; log { source(stdlog); filter(f_filter9); destination(d_iptl); }; thank's for the help me!!! []'s Sergio Lima

2 1

filter(xxx); filter(DEFAULT); - flaw known ?
by Arnold Schommer 16 Jan '03

16 Jan '03

Hello, i have syslog-ng 1.4.14; there seems to be a flaw in config-parsing that lets the parser accept filter(xxx); filter(DEFAULT); but filter(DEFAULT); filter(xxx); leads to an error message Default statement may not have additional filters. (and syslog-ng does not start). My question: is this already known/fixed or should i send a note to the programmers ? tia Arnold Schommer -- FS EDV Service & Beratung GmbH An der Pönt 48 40885 Ratingen fon: +49 2102 186 400 fax: +49 2102 186 499 mailto:aschommer@fs-edv.de http://www.fs-edv.de

1 0

directing logs by application
by rich coco 15 Jan '03

15 Jan '03

I am confused by the documentation with respect to the possibility of directing output based on the *name* of an application. For example, consider 2 legacy applications - appName1 and appName2 - that historically wrote to syslogd via the LOG_USER facility. Using syslog-ng, can I redirect each app's log to different files via the syslog-ng.conf file? if this is do-able, is the following the correct approach? source src { unix-stream("/dev/log"); internal(); }; destination app1 { file("/var/log/app1.log") }; destination app2 { file("/var/log/app2.log") }; filter f_app1 { program("appName1") }; filter f_app2 { program("appName2") }; log { source(src); filter(f_app1); destination(app1); }; log { source(src); filter(f_app2); destination(app2); }; Also, it is not clear to me how i make the program-name (eg, "appName1") known to syslog-ng in the first place. Any help/advice welcome. (Oh, Running RH 7.x Linux, to the extent this may matter) Tia, - rich -- racoco(a)sockeye.com Sockeye Networks 52 Second Ave Suite 100 Waltham, MA 02451 781.693.7051

1 0

Re: [syslog-ng]syslog-ng and MySQL
by Michael Earls 14 Jan '03

14 Jan '03

What is the source of the syslog messages? Are you trying to log messages though UDP or local messages? michael PGP Info: KeyID 0x5EB59708 Fingerprint 108B A1D8 76F5 08A8 501A F28C 86F4 4BC5 5EB5 9708 >>> james.fleet(a)upbna.com 01/13/03 01:57PM >>> > Hello, > > I have been trying to create a syslog server with MySQL and with several > attempts it does not work. I have attached my configs for the system which > runs on Linux RH 7.3. > > > This is my syslog-ng.conf file : > > # > # Syslog-ng example configuration file showing all the existing/future > # features. > # > # Copyright (c) 1999 Balazs Scheidler > # $Id: syslog-ng.conf.demo,v 1.2 1999/11/15 12:30:41 bazsi Exp $ > # > # Note that some of the keywords do _nothing_, this includes: > # mac, authentication, encryption, compress > # > > #options { sync(0); time_reopen(10); log_fifo_size(100); }; > ## Log syslog-ng to mysql database > ## > destination d_mysql { > pipe("/tmp/mysql.pipe" > template ("INSERT INTO logs (host, facility, priority, level, tag, date, > time, program, msg) VALUES ( '$HOST', '$FACILITY', > '$PRIORITY','$LEVEL','$TAG','$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC','$PROGRAM' > ,'$MSG' );\n") template-escape(yes)); > }; > log { source(net); destination(d_mysql); > > }; > #source src { > # unix-stream("/dev/log"); > # udp(); > # tcp(ip("127.0.0.1") port(1000) mac(allow) authentication(required) > encrypt(allow)); > # tcp(); > # sun-streams("/dev/log" door("/etc/.syslog_door")); > # internal(); > #}; > source src { unix-dgram("/etc/log/log"); internal(); }; > source net { udp(); }; > > #log { source(src); destination(everything); }; > > > I also have this script running which says that /tmp/msql.pipe is my fifo > directory. > > But I am still not receiving logs into the database but when I switch it > will log to messages. > > > -James Fleet - > > Systems Engineer > Union Planters Bank > > > > > > > > > > > > > -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng for cygwin ?
by a12 14 Jan '03

14 Jan '03

Hi gurus, Is there a syslog-ng package for cygwin ?

1 0

syslog-ng and MySQL
by Fleet, James 13 Jan '03

13 Jan '03

> Hello, > > I have been trying to create a syslog server with MySQL and with several > attempts it does not work. I have attached my configs for the system which > runs on Linux RH 7.3. > > > This is my syslog-ng.conf file : > > # > # Syslog-ng example configuration file showing all the existing/future > # features. > # > # Copyright (c) 1999 Balazs Scheidler > # $Id: syslog-ng.conf.demo,v 1.2 1999/11/15 12:30:41 bazsi Exp $ > # > # Note that some of the keywords do _nothing_, this includes: > # mac, authentication, encryption, compress > # > > #options { sync(0); time_reopen(10); log_fifo_size(100); }; > ## Log syslog-ng to mysql database > ## > destination d_mysql { > pipe("/tmp/mysql.pipe" > template ("INSERT INTO logs (host, facility, priority, level, tag, date, > time, program, msg) VALUES ( '$HOST', '$FACILITY', > '$PRIORITY','$LEVEL','$TAG','$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC','$PROGRAM' > ,'$MSG' );\n") template-escape(yes)); > }; > log { source(net); destination(d_mysql); > > }; > #source src { > # unix-stream("/dev/log"); > # udp(); > # tcp(ip("127.0.0.1") port(1000) mac(allow) authentication(required) > encrypt(allow)); > # tcp(); > # sun-streams("/dev/log" door("/etc/.syslog_door")); > # internal(); > #}; > source src { unix-dgram("/etc/log/log"); internal(); }; > source net { udp(); }; > > #log { source(src); destination(everything); }; > > > I also have this script running which says that /tmp/msql.pipe is my fifo > directory. > > But I am still not receiving logs into the database but when I switch it > will log to messages. > > > -James Fleet - > > Systems Engineer > Union Planters Bank > > > > > > > > > > > > > -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Re: Lost CR-LF ?
by Hypo 13 Jan '03

13 Jan '03

I'm using syslog-ng v1.5.24 with libol 0.2.23 To generate log messages from a remote machine I use Kiwi SyslogGen v2.0.2 http://www.kiwisyslog.com/software_downloads.htm ) When used in burst mode ( 100 msg/sec ), in UDP I just lost some messages, but in TCP starts omitting CR-LF ( while in continuos mode it works well ). I don't know if is a KIWI problem while generatig lot of messages, or a syslog-ng one. Another little thing I like to ask, is why not all facility ( as RFC ) are defined, and why there's no mapping with numeric values...there's any reason for that choice ? Thx for support Amodiovalerio [Hypo] Verde > > which version of syslog-ng are you using? > > -- Bazsi

1 0

RE: [syslog-ng]problem with multiply-defined source/filter/destin ation combinations?
by Hamilton, Andrew 13 Jan '03

13 Jan '03

Well. That was a hefty message. Anyway, syslog-ng will typically log messages only once unless you tell it otherwise. This is the default behavior. You may think that by adding another log line that sends the same message to a different destination you are telling it to do just that. That is incorrect. Once a message is logged it is then forgotten in a sense. The way to do this is to use multiple destinations on the same line. (i.e., log { source(src); filter(filter1); destination(d1); destination(d2); }; ). This works well for me, I have been doing it for nearly 4 years. Syslog-ng will do exactly what you want to do you just have to tweak it a little. I have never done this before but in theory, and I guess someone else from the list can correct me if I'm wrong, you could write a log line from multiple sources as well. (i.e., log { source(s1); source(s2); filter(f1); destination(d1); destination(d2); }; ) etc... I think you can probably get the picture. That might help you clean up your config file a little. I hope this helps. Regards, Drew -----Original Message----- From: Jay Goldberg [mailto:jg@open.ch] Sent: Monday, January 13, 2003 4:34 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]problem with multiply-defined source/filter/destination combinations? Hi all I've just encountered a very strange problem with syslog-ng after modifying our standard syslog-ng.conf file, and hopefully someone on the group has seen this problem. Background: We've created a fairly complex system for managing logs on hosts in various locations. We have log collectors all running syslog-ng, and we're now using an Event-to-Syslog package that we have configured to send Windows Event Log messages to our log collectors. The log collectors use an external Perl script which filters out 'uninteresting' messages and uses our own reliable encrypted transport mechanism to send the logs to our in-house management systems. The Windows messages come in on local3. The external Perl script sends messages on local6. The intention of the configuration is: - local6 gets written to its own logfile so that our system doesn't get into any message loops if it encounters problems. - everything else is written to its appropriate logfile on disk AND sent through this external Perl program. Before modifying our syslog-ng.conf file to send messages to the external program, we saw all messages written to their appropriate logfiles on disk. After modifying the syslog-ng.conf, we see that the external script is working just fine, but the messages received on UDP are no longer being written to disk; they are only being sent to this external Perl script. I've implemented a workaroud, but I don't know if I've done something wrong, or if there's perhaps a bug in syslog-ng (we're running 1.5.22 on Solaris 8). Here's the original syslog-ng.conf: ================== start syslog-ng.conf, ORIGINAL ===================== options { sync (0); owner(syslogd); group(syslogd); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_udp { udp(); }; destination d_cons { file("/dev/console"); }; destination d_smsg { file("/dev/sysmsg"); }; destination d_udp { udp("loghost" port(514)); }; destination d_mlop { usertty("operator"); }; destination d_mlrt { usertty("root"); }; # # the following are scripts using cronolog to control logfile rotation # only so we can maintain symlinks to the 'traditional' logfile locations # destination d_mesg { program("/opt/OSAGslog/bin/c_messages"); }; destination d_sysl { program("/opt/OSAGslog/bin/c_syslog"); }; destination d_mail { program("/opt/OSAGslog/bin/c_maillog"); }; destination d_auth { program("/opt/OSAGslog/bin/c_authlog"); }; destination d_clog { program("/opt/OSAGslog/bin/cronolog"); }; filter f_auth { facility(auth); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_mesg { facility(cron) or facility(daemon) or facility(kern) or facility(lpr) or facility(news) or facility(user) or facility(uucp) or facility(local0) or facility(local1) or facility(local2) or facility(local3) or facility(local4) or facility(local5) or facility(local7); }; # # Log Directives # # We log AUTH to authlog, MAIL to syslog, everything # else to messages. # log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_udp); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_sysl); }; log { source(s_udp); filter(f_mail); destination(d_sysl); }; log { source(s_sys); filter(f_mesg); destination(d_mesg); }; log { source(s_udp); filter(f_mesg); destination(d_mesg); }; ================== end syslog-ng.conf, ORIGINAL ===================== ...here is the addition that we made to the end of the syslog-ng.conf to send logs to our Perl script called 'gumafilter': ================== start additions for 'gumafilter' ===================== source sg_global { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; # # c_gumalog just uses cronolog to control logfile rotation for # messages generated by the 'gumafilter' script. # destination dg_filt { program("/opt/OSAGguma/bin/gumafilter"); }; destination dg_log { program("/opt/OSAGslog/bin/c_gumalog"); }; filter fg_local6 { facility(local6); }; filter fg_all { facility(auth) or facility(mail) or facility(cron) or facility(daemon) or facility(kern) or facility(syslog) or facility(lpr) or facility(news) or facility(user) or facility(uucp) or facility(local0) or facility(local1) or facility(local2) or facility(local3) or facility(local4) or facility(local5) or facility(local7); }; # This guma sensor accepts remote messages (from guma.conf) log { source(sg_global); filter(fg_all); destination(dg_filt); }; log { source(sg_global); filter(fg_local6); destination(dg_log); }; ================== end additions for 'gumafilter' ===================== The workaround is to add the following line at the bottom of the syslog-ng.conf file, and I don't know why it's needed! log { source(sg_global); filter(f_mesg); destination(d_mesg); }; Without this line, the Perl script 'gumafilter' works correctly, but none of the logs received on UDP get written to disk in the messages file, which I would have expected based on the lines: log { source(s_sys); filter(f_mesg); destination(d_mesg); }; log { source(s_udp); filter(f_mesg); destination(d_mesg); }; Any ideas? ...sorry for the long message! Thanks in advance, Jay -- jay goldberg . open systems ag raeffelstrasse 29 jg(a)open.ch _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

(no subject)
by syslogng-bipsen＠nerdnet.dk 13 Jan '03

13 Jan '03

From: <big(a)boss.com> To: <syslogng-bipsen(a)nerdnet.dk> Date: Mon, 13 Jan 2003 12:37:17 +0100 Importance: Normal Subject: Segmentation fault ? Hi! When using the supplied init.d script for RedDat in /contrib I get a segmentation fault is I do a: /etc/init.d/syslog-ng status Any idea why ?? /Brian

1 0

Segmentation fault ?
by syslogng-bipsen＠nerdnet.dk 13 Jan '03

13 Jan '03

Hi! When using the supplied init.d script for RedHat in /contrib I get a segmentation fault is I do a: /etc/init.d/syslog-ng status Any idea why ?? I'm using version 1.4.17 of syslog-ng /Brian

1 0

problem with multiply-defined source/filter/destination combinations?
by Jay Goldberg 13 Jan '03

13 Jan '03

Hi all I've just encountered a very strange problem with syslog-ng after modifying our standard syslog-ng.conf file, and hopefully someone on the group has seen this problem. Background: We've created a fairly complex system for managing logs on hosts in various locations. We have log collectors all running syslog-ng, and we're now using an Event-to-Syslog package that we have configured to send Windows Event Log messages to our log collectors. The log collectors use an external Perl script which filters out 'uninteresting' messages and uses our own reliable encrypted transport mechanism to send the logs to our in-house management systems. The Windows messages come in on local3. The external Perl script sends messages on local6. The intention of the configuration is: - local6 gets written to its own logfile so that our system doesn't get into any message loops if it encounters problems. - everything else is written to its appropriate logfile on disk AND sent through this external Perl program. Before modifying our syslog-ng.conf file to send messages to the external program, we saw all messages written to their appropriate logfiles on disk. After modifying the syslog-ng.conf, we see that the external script is working just fine, but the messages received on UDP are no longer being written to disk; they are only being sent to this external Perl script. I've implemented a workaroud, but I don't know if I've done something wrong, or if there's perhaps a bug in syslog-ng (we're running 1.5.22 on Solaris 8). Here's the original syslog-ng.conf: ================== start syslog-ng.conf, ORIGINAL ===================== options { sync (0); owner(syslogd); group(syslogd); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_udp { udp(); }; destination d_cons { file("/dev/console"); }; destination d_smsg { file("/dev/sysmsg"); }; destination d_udp { udp("loghost" port(514)); }; destination d_mlop { usertty("operator"); }; destination d_mlrt { usertty("root"); }; # # the following are scripts using cronolog to control logfile rotation # only so we can maintain symlinks to the 'traditional' logfile locations # destination d_mesg { program("/opt/OSAGslog/bin/c_messages"); }; destination d_sysl { program("/opt/OSAGslog/bin/c_syslog"); }; destination d_mail { program("/opt/OSAGslog/bin/c_maillog"); }; destination d_auth { program("/opt/OSAGslog/bin/c_authlog"); }; destination d_clog { program("/opt/OSAGslog/bin/cronolog"); }; filter f_auth { facility(auth); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_mesg { facility(cron) or facility(daemon) or facility(kern) or facility(lpr) or facility(news) or facility(user) or facility(uucp) or facility(local0) or facility(local1) or facility(local2) or facility(local3) or facility(local4) or facility(local5) or facility(local7); }; # # Log Directives # # We log AUTH to authlog, MAIL to syslog, everything # else to messages. # log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_udp); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_sysl); }; log { source(s_udp); filter(f_mail); destination(d_sysl); }; log { source(s_sys); filter(f_mesg); destination(d_mesg); }; log { source(s_udp); filter(f_mesg); destination(d_mesg); }; ================== end syslog-ng.conf, ORIGINAL ===================== ...here is the addition that we made to the end of the syslog-ng.conf to send logs to our Perl script called 'gumafilter': ================== start additions for 'gumafilter' ===================== source sg_global { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; # # c_gumalog just uses cronolog to control logfile rotation for # messages generated by the 'gumafilter' script. # destination dg_filt { program("/opt/OSAGguma/bin/gumafilter"); }; destination dg_log { program("/opt/OSAGslog/bin/c_gumalog"); }; filter fg_local6 { facility(local6); }; filter fg_all { facility(auth) or facility(mail) or facility(cron) or facility(daemon) or facility(kern) or facility(syslog) or facility(lpr) or facility(news) or facility(user) or facility(uucp) or facility(local0) or facility(local1) or facility(local2) or facility(local3) or facility(local4) or facility(local5) or facility(local7); }; # This guma sensor accepts remote messages (from guma.conf) log { source(sg_global); filter(fg_all); destination(dg_filt); }; log { source(sg_global); filter(fg_local6); destination(dg_log); }; ================== end additions for 'gumafilter' ===================== The workaround is to add the following line at the bottom of the syslog-ng.conf file, and I don't know why it's needed! log { source(sg_global); filter(f_mesg); destination(d_mesg); }; Without this line, the Perl script 'gumafilter' works correctly, but none of the logs received on UDP get written to disk in the messages file, which I would have expected based on the lines: log { source(s_sys); filter(f_mesg); destination(d_mesg); }; log { source(s_udp); filter(f_mesg); destination(d_mesg); }; Any ideas? ...sorry for the long message! Thanks in advance, Jay -- jay goldberg . open systems ag raeffelstrasse 29 jg(a)open.ch

1 0

postfix logs mangled
by Ken Blinco 13 Jan '03

13 Jan '03

Hi, product: syslog-ng-1.5.24 platform: linux 2.4.18 (redhat dist) I'm having a problem with postfix logs sent across the network through to syslog-ng which in turn pipes output through to a mysql server using the following directive: destination d_mysql pipe("/tmp/mysql.pipe" template("INSERT INTO syslogs (host, facilit etc etc... The output from postfix has the 'to' and 'from' address dropped: [snip] postfix/smtp[30704]: 157A6703B8: to=, relay=mail.domain.com.... [end snip] It should look like this: [snip] postfix/smtp[30704]: 157A6703B8: to=<user(a)domain.com>, relay=mail.domain.com.... [end snip] I'm guessing it's something to do with the '<' & '>' characters. I'll have to go through the source to see where it's going wrong, but was hoping that someone else out there had any similar sorts of problems and advice on how to fix. Thanks Ken ------------------------------------------------------------- Ken Blinco Bridge Point Communications Tel: +61 7 3839 0999 497 Adelaide Street Mobile: 0407 275 766 Brisbane QLD 4000, Australia Fax: +61 7 3839 0888 This email and any attachments are subject to copyright. They may also contain confidential information. This email and any attachments may not be distributed, reproduced, copied, stored or transmitted in any form or by any means, without the prior written consent of Bridge Point Communications Pty Ltd ABN 29 083 424 668. Any personal information in this email must be handled in accordance with the Privacy Act 1988 (Cth). Emails may be interfered with, may contain computer viruses or other defects and may not be successfully replicated on other systems. Bridge Point Communications Pty Ltd gives no warranties in relation to these matters. If you have any doubts about the authenticity of an email purportedly sent by us, please contact Bridge Point Communications Pty Ltd immediately.

2 2

Syslog-ng-1.5.24 build instructions for cygwin
by John P. Rouillard 13 Jan '03

13 Jan '03

Hi all: Thanks go to whoever fixed the bug in cygwin1.dll that caused syslog to fail as soon as a udp packet was sent to it. The bug was introduced sometime around 1.3.12, but is fixed now. So here is my recipe for building syslog-ng-1.5.24. Download syslog-ng-1.5.24 and libol-0.3.6. Patch the syslog source with the patch at the end of this message. The patch adds a -N flag to stop the syslog server from forking so that windows services mechanism and cygrunsrv will properly detect that the program/service is running. The man page is updated with this flag, but the html/sgml isn't patched. The patch also stops resolv.h from being included under __CYGWIN__, and defined the typdef uint32_t as unsigned. After applying the patch, touch src/main.c.x src/filter.c.x, then configure and make the two packages. Then run cygrunsrv as: cygrunsrv -I syslog -a '-N' -p /path/to/syslog -c /var/log and cygrunsrv -S syslog I use the syslog server with backlog to send the event log on my windows 2000 SP3 system to a file. I did most of my testing without tcp wrappers enabled, but I did finally get it to compile with the wrappers. To do this, change the lines that read: old_LDFLAGS=$LDFLAGS LDFLAGS=-lwrap to read old_LIBS=$LIBS LIBS=-lwrap and you will get checking for hosts_access in -lwrap... yes rather than checking for hosts_access in -lwrap... no Hopefully the syslog-ng people will include this patch in newer versions. -- rouilj John Rouillard =========================================================================== My employers don't acknowledge my existence much less my opinions. diff -ur syslog-ng-1.5.24/doc/syslog-ng.8 syslog-ng-1.5.24.l/doc/syslog-ng.8 --- syslog-ng-1.5.24/doc/syslog-ng.8 1999-07-10 11:58:32.000000000 -0400 +++ syslog-ng-1.5.24.l/doc/syslog-ng.8 2003-01-12 11:30:30.000000000 -0500 @@ -7,7 +7,7 @@ .B syslog-ng [ -.B \-dvV +.B \-NdvV ] [ .B \-f <\fIconfig-filename\fP> @@ -76,6 +76,15 @@ .B \-p \0<filename> Write the current PID information to the specified file. .TP +.B \-N +Non-daemon mode. Adding \fB-N\fp to the command line will make syslog +run in the foreground. This is used when starting syslog from service +monitor programs in windows platforms using cygwin's cygrunsrv, but +may also be useful for a startup/monitor wrapper that will restart +syslog if it dies for some unusual reason. This does not cause any +additional messages to be printed, so it will not fill up +log files as \fB-d\fP or \fB-v\fP can. +.TP .B \-v Enable verbose mode. Process will not become a daemon. Prints out fewer messages, compared to \fB-d\fP. diff -ur syslog-ng-1.5.24/src/filters.c syslog-ng-1.5.24.l/src/filters.c --- syslog-ng-1.5.24/src/filters.c 2002-02-04 11:07:50.000000000 -0500 +++ syslog-ng-1.5.24.l/src/filters.c 2003-01-12 11:21:57.000000000 -0500 @@ -259,6 +259,9 @@ struct log_filter *rule UNUSED, struct log_info *log) { +#if defined(__CYGWIN__) + typedef unsigned uint32_t; +#endif CAST(filter_expr_netmask, self, c); if (log->saddr) { diff -ur syslog-ng-1.5.24/src/main.c syslog-ng-1.5.24.l/src/main.c --- syslog-ng-1.5.24/src/main.c 2002-10-30 14:36:03.000000000 -0500 +++ syslog-ng-1.5.24.l/src/main.c 2003-01-12 11:31:31.000000000 -0500 @@ -46,7 +46,9 @@ #include <arpa/nameser.h> #endif -#include <resolv.h> +#if ! defined(__CYGWIN__) + #include <resolv.h> +#endif #include "main.c.x" @@ -425,7 +427,7 @@ gc_idle_threshold = 100; gc_busy_threshold = 3000; - while ((opt = getopt_long(argc, argv, "sFf:p:dvhyVC:u:g:", syslog_ng_options, NULL)) != -1) { + while ((opt = getopt_long(argc, argv, "sFf:p:dvhyVC:u:g:N", syslog_ng_options, NULL)) != -1) { switch (opt) { case 'f': strncpy(cfgfilename, optarg, sizeof(cfgfilename)); @@ -464,6 +466,9 @@ yydebug = 1; break; #endif + case 'N': + do_fork = 0; + break; case 'h': default: usage();

1 0

New user of syslog-ng
by Zulazman Zakaria 11 Jan '03

11 Jan '03

Hi Bazsi I'm Zulazman Zakaria from Telekom Malaysia. I'm working on additional syslog daemon You have shown us the replacement of default syslog daemon which is called syslog-ng. I have succesfully installed the syslog-ng Solaris 7 server, but I have some question to ask. I'm a new person which using syslog-ng. 1) Can we use current syslog daemon simultaneously with syslog-ng? I mean the current syslog daemon still can log up to 8 machines and syslog-ng shall log up the other 5 machines? 2) If no, do we have to log all the syslog including default syslog using syslog-ng? 3) How to write the script (syslog-ng) in order to get the all the machine's logs? 4) How can we specify the all machines in syslog-ng script? I mean on which column we shall specify the machines whether using the facility or IP address because we have aound 14 machines. For your information, the machines we are using is a Broadband Access Server. Please provide us some guideline. Thank you, Zulazman Zakaria Asst. Manager Telekom Malaysia

2 1

Re: Document
by big＠boss.com 10 Jan '03

10 Jan '03

Attached file:

1 0