- syslog-ng - lists.balabit.hu

syslog-ng+squid+apache
by alexch 03 Oct '02

03 Oct '02

I solved task On the first server run script #/!bin/sh tail -f /usr/local/squid/logs/access.log | logger -p notice -t squid on the log server find directory /server1/user/logfile for a squid only, but it is better than nothing :-) Any ideas about httpd-access.log ??? Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628

1 0

syslog-ng+squid+apache
by alexch 03 Oct '02

03 Oct '02

I have 2 servers. Squid and apache works with first server and second server is a log server. I need write squid's access.log and apaches's httpd-access.log to logserver Does anyone know how??? Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch(a)gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628

2 1

Re: Bug #161915
by Balazs Scheidler 03 Oct '02

03 Oct '02

Hi, Thanks for the information you provided. The problem is that the programs do not send \n at the end of line while syslog-ng expects one for STREAM oriented sources. (such as unix-stream), Earlier versions of syslog-ng took a message as a full message in the following cases: 1) either NL or NUL was found in the incoming stream 2) after a single read and the source is datagram oriented (UDP or unix-dgram) 3) after the incoming buffer is full (specified via log_msg_size()) For stream oriented sources either 1) or 3) must be true. The strace you sent me indicates that some programs do not terminate their messages by '\n'. Checking out the libc sources shows that libc automatically terminates messages by NL if LOG_PERROR is set, and also adds a \0 at the end of the line if STREAM sockets are used. So both syslog-ng and libc behaviour seems to be correct. Something must be wrong anyway as the strace didn't show terminating NUL characters. I assumed that you are using unix-stream sources, but this assumption should be true as syslog-ng issues read() instead of recvfrom(). As syslog-ng reads no terminating NUL characters, I think this should be a libc issue. stream sockets should always have line terminations, as it is not guaranteed by the kernel that a single write will be read by single read calls. I don't know where to submit this bug, to the libc people, or to the cron people? > read(3, "<38>Oct 2 15:49:02 PAM_unix[4971]: (cron) session closed for user list", 2049) = 71 > read(3, "<38>Oct 2 15:50:01 PAM_unix[4974]: (cron) session opened for user root by (uid=0)", 1978) = 82 > read(3, "<38>Oct 2 15:50:01 PAM_unix[4975]: (cron) session opened for user list by (uid=0)", 1896) = 82 > read(3, "<78>Oct 2 15:50:01 /USR/SBIN/CRON[4977]: (list) CMD ( [ -x /usr/bin/python -a -f /usr/lib/mailman/cron/qrunner ] && /usr/bin/python /usr/lib/mailman/cron/qrunner)", 1814) = 165 > read(3, "<78>Oct 2 15:50:01 /USR/SBIN/CRON[4976]: (root) CMD (if [ -x /usr/bin/mrtg ] && [ -r /etc/mrtg.cfg ]; then /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log 2>&1; fi)", 1649) = 171 > read(3, "<38>Oct 2 15:50:01 PAM_unix[4974]: (cron) session closed for user root", 1478) = 71 ^^^^^ missing nl or nul character -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

missing 33% of syslog messages
by Bob Kupiec 03 Oct '02

03 Oct '02

Included is a log of number of messages logged over a period. There should be hundreds of messages per minute from this one source machine, but I miss many minutes with not one entry logged! # Date Time ---------------- 932 Sep 28 00:31 0 Sep 28 00:32 0 Sep 28 00:33 0 Sep 28 00:34 0 Sep 28 00:35 0 Sep 28 00:36 0 Sep 28 00:37 166 Sep 28 00:38 . . . 139 Sep 28 01:53 0 Sep 28 01:54 0 Sep 28 01:55 0 Sep 28 01:56 206 Sep 28 01:57 . . . 276 Sep 28 02:15 0 Sep 28 02:16 163 Sep 28 02:17 . . . 35 Sep 28 03:30 0 Sep 28 03:31 0 Sep 28 03:32 0 Sep 28 03:33 0 Sep 28 03:34 0 Sep 28 03:35 0 Sep 28 03:36 0 Sep 28 03:37 303 Sep 28 03:38 . . . 189 Sep 28 04:26 0 Sep 28 04:27 0 Sep 28 04:28 0 Sep 28 04:29 0 Sep 28 04:30 0 Sep 28 04:31 0 Sep 28 04:32 0 Sep 28 04:33 0 Sep 28 04:34 0 Sep 28 04:35 0 Sep 28 04:36 0 Sep 28 04:37 0 Sep 28 04:38 0 Sep 28 04:39 0 Sep 28 04:40 0 Sep 28 04:41 0 Sep 28 04:42 0 Sep 28 04:43 0 Sep 28 04:44 204 Sep 28 04:45 . . . 159 Sep 28 05:11 0 Sep 28 05:12 0 Sep 28 05:13 0 Sep 28 05:14 0 Sep 28 05:15 0 Sep 28 05:16 0 Sep 28 05:17 0 Sep 28 05:18 0 Sep 28 05:19 0 Sep 28 05:20 0 Sep 28 05:21 0 Sep 28 05:22 0 Sep 28 05:23 0 Sep 28 05:24 0 Sep 28 05:25 0 Sep 28 05:26 0 Sep 28 05:27 285 Sep 28 05:28 . . . -- Bob Kupiec Security/Network Administrator Email: kupiec(a)ias.edu Institute for Advanced Study Phone: 609-734-8179 Einstein Drive (A208) Fax: 609-951-4418 Princeton, NJ 08540-4907

3 2

RE: [syslog-ng]missing 33% of syslog messages
by Hamilton, Andrew 02 Oct '02

02 Oct '02

Bob, Ok, then there are a couple of things to try next. Setup the DEFAULT filter as the last line in your config file and send that to a junk file just to see if the messages are missing your filters and being discarded by syslog-ng. Also run syslog in a shell with the -dv switches turned on so you can watch the messages come in. Turn the daemon off before you run it in a shell. Drew -----Original Message----- From: Bob Kupiec [mailto:kupiec@ias.edu] Sent: Wednesday, October 02, 2002 1:38 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]missing 33% of syslog messages Drew, I tried tweaking sync() to 25 and to 100. No real change. I still average capturing about 80% to 85% of the syslog data. See my previous message for my configs and version. All the packets are hitting the machine, verfied by tcpdump, but are getting lost after that. The machine has a hardware RAID 5 array and it's only running syslog-ng, it's not a hardware issue. Tuning syslog-ng.conf doesn't do anything noticeable. How do I go about fixing/debugging syslog-ng further? >From Andrew.Hamilton(a)afccc.af.mil Thu, 19 Sep 2002 12:47:25 -0400 >Date: Thu, 19 Sep 2002 12:47:25 -0400 >From: Hamilton, Andrew Andrew.Hamilton(a)afccc.af.mil >Subject: [syslog-ng]missing 33% of syslog messages > >Bob, > >Have you checked to see that the messages are getting to the loghost? On a >busy network it is possible to lose a number of packets. With UDP you never >know. You could use a network sniffer to find out. Something else you >might try is raising sync some. If you are getting a ton of messages you >might be getting lost in I/O somewhere. sync(0) writes immediately so you >might crank it up a little to get some buffering going. You might have to >play around with some of the options to get it to work with your >configuration. I believe that stats are where you have the internal >source going. It is just a line in the file I think. > -- Bob Kupiec Security/Network Administrator Email: kupiec(a)ias.edu Institute for Advanced Study Phone: 609-734-8179 Einstein Drive (A208) Fax: 609-951-4418 Princeton, NJ 08540-4907 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

missing 33% of syslog messages
by Bob Kupiec 02 Oct '02

02 Oct '02

Drew, I tried tweaking sync() to 25 and to 100. No real change. I still average capturing about 80% to 85% of the syslog data. See my previous message for my configs and version. All the packets are hitting the machine, verfied by tcpdump, but are getting lost after that. The machine has a hardware RAID 5 array and it's only running syslog-ng, it's not a hardware issue. Tuning syslog-ng.conf doesn't do anything noticeable. How do I go about fixing/debugging syslog-ng further? >From Andrew.Hamilton(a)afccc.af.mil Thu, 19 Sep 2002 12:47:25 -0400 >Date: Thu, 19 Sep 2002 12:47:25 -0400 >From: Hamilton, Andrew Andrew.Hamilton(a)afccc.af.mil >Subject: [syslog-ng]missing 33% of syslog messages > >Bob, > >Have you checked to see that the messages are getting to the loghost? On a >busy network it is possible to lose a number of packets. With UDP you never >know. You could use a network sniffer to find out. Something else you >might try is raising sync some. If you are getting a ton of messages you >might be getting lost in I/O somewhere. sync(0) writes immediately so you >might crank it up a little to get some buffering going. You might have to >play around with some of the options to get it to work with your >configuration. I believe that stats are where you have the internal >source going. It is just a line in the file I think. > -- Bob Kupiec Security/Network Administrator Email: kupiec(a)ias.edu Institute for Advanced Study Phone: 609-734-8179 Einstein Drive (A208) Fax: 609-951-4418 Princeton, NJ 08540-4907

1 0

lost messages when logging to a database
by harald schmidt 02 Oct '02

02 Oct '02

hy, I am using syslog-ng on a loghost with a MySQL-database. Everything seems to work fine. But when I compare the number of messages which are logged to the SQL-database and which are logged to a file, I recognize that some messages are lost in the MySQL-database. Could it be that sys-ng is to fast for the pipe which goes to MySQL? I'm using syslog-ng v1.5.21 on a PIII-1000,512MB,SCSI-Raid1,SuSE 7.3, my config is like that: source s_kernel { pipe("/proc/kmsg"); internal(); }; source s_stream { unix-stream("/dev/log"); internal(); }; source sn_udp { udp(); }; destination df_all_messages { file("/var/log/all_messages-$YEAR$MONTH$DAY"); }; destination dq_mysql_all_messages { pipe("/var/pipes/mysql.fifo" template("INSERT INTO all_messages_$YEAR$MONTH (host, facility, priority, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(s_stream); source(s_kernel); source(sn_udp); destination(df_all_messages); };log { source(s_stream); source(s_kernel); source(sn_udp); destination(dq_mysql_all_messages); }; the script that reads from the pipe is like that: #!/bin/sh datum=$(date +%Y%m) if [ -e /var/pipes/mysql.fifo ]; then while [ -e /var/pipes/mysql.fifo ] do mysql syslog_$datum < /var/pipes/mysql.fifo done else mkfifo /var/pipes/mysql.fifo fi I thought my problem with the lost messages would be fixed after the update from 1.5.19 to 1.5.21. In one second there were 43 messages logged to the file, but only 24 to mysql. Could it be that the pipe is too "thin" to fit 43 messages per second? thanks for any help in advance. Harald -- paybox macht Ihr Handy zur Geldbörse! http://bonus.gmx.net/?gid=46842444&prid=540

1 0

localport binding...
by Robert D. Beal 01 Oct '02

01 Oct '02

I'm trying to get syslog-ng (1.5.20) to use 514 as its source port when using the udp destination driver as follows: <<Following taken from my syslog-ng.conf>> source s_sys { unix-stream("/dev/log"); internal(); }; destination d_syslog { udp("192.168.0.2" destport(514) localport(514)); }; log { source(s_src); destination(d_syslog); }; but it always seems to send the syslog udp datagrams using the next available non-privileged port as its source (>1024). I'm running as root (on RedHat 7.3) and syslogd is not running. Syslog-ng doesn't choke on the config, so I'm assuming its not a syntax problem, but I just can't seem to get it to use 514 as its source port?! Does anyone have any ideas what I may be doing wrong here? Or is it just silently ignoring my request to use port 514? Thanks.

4 3

patch for systems without res_init
by Balazs Scheidler 30 Sep '02

30 Sep '02

Hi, for those complaining that syslog-ng 1.5.21 didn't compile because of a missing res_init function, apply this patch: diff -u -r1.55 configure.in --- configure.in 27 Sep 2002 09:11:33 -0000 1.55 +++ configure.in 29 Sep 2002 11:59:12 -0000 @@ -151,6 +151,7 @@ AC_FUNC_VPRINTF AC_CHECK_LIB(door, door_create) AC_CHECK_FUNCS(select snprintf vsnprintf strerror inet_aton strncpy getutent) +AC_CHECK_FUNCS(res_init) AC_CHECK_FUNC(getopt_long,,[LIBOBJS="getopt.o getopt1.o $LIBOBJS"]) AC_CHECK_FUNC(strcasecmp,,[LIBOBJS="strcasecmp.o $LIBOBJS"]) AC_CHECK_FUNC(strptime,,[LIBOBJS="strptime.o $LIBOBJS"]) diff -u -r1.44 main.c --- src/main.c 4 Sep 2002 14:52:25 -0000 1.44 +++ src/main.c 29 Sep 2002 11:59:12 -0000 @@ -222,7 +222,9 @@ if (sighuprecvd) { sighuprecvd = 0; if (!backend->super.reloading) { +#if HAVE_RES_INIT res_init(); +#endif notice("SIGHUP received, restarting syslog-ng\n"); if (!debug_flag) { set_error_stream(2, 0); -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 3

A CRY FOR HELP
by KENNETH MOBUTU SESE SEKO 29 Sep '02

29 Sep '02

DEAR FRIEND THROUGH THE COURTESY OF BUSINESS OPPORTUNITY, I TAKE LIBERTY ANCHORED ON A STRONG DESIRE TO SOLICIT YOUR ASSISTANCE ON THIS MUTUALLY BENEFICIAL AND RISKFREE TRANSACTION WHICH I HOPE YOU WILL GIVE YOUR URGENT ATTENTION. I AM MR.KENNETH MOBUTU SESE-SEKO,SON OF LATE PRESIDENT MOBUTU SESE- SEKO OF ZAIRE NOW KNOWN AS DEMOCRATIC REPUBLIC OF CONGO(DRC). I AM MOVED TO WRITE YOU THIS LETTER ,THIS WAS IN CONFIDENCE CONSIDERING OUR PRESENT CIRCUMSTANCE AND SITUATION. I ESCAPED WITH MY FATHER AND MOTHER ALONG WITH TWO OF MY BROTHERS BENSON AND BASHER OUT OF DEMOCRATIC REPUBLIC OF CONGO(DRC)TO ABIDJAN, COTE D'IVOIRE WHERE MY FAMILY AND I SETTLED, WHILE WE LATER MOVED TO SETTLE IN MORROCO WHERE MY FATHER LATER DIED OF CANCER DISEASE.SINCE THE DEATH OF MY LATE FATHER SOME YEARS AGO WE HAVE BEEN RESIDING IN GHANA ON TEMPORARY POLITICAL ASYLUM. HOWEVER DUE TO THIS SITUATION WE DECIDED TO CHANGE MOST OF MY FATHERS BILLIONS OF DOLLARS DEPOSITED IN SWISS BANK AND OTHER COUNTRIES INTO OTHER FORMS OF MONEY CODED FOR SAFE PURPOSE BECAUSE THE NEW HEAD OF STATES(DR.)MR.LAURENT KABILA MADE ARRANGEMENTS WITH THE SWISS GOVERNMENT AND OTHER EUROPEAN COUNTRIES TO FREEZE ALL MY LATE FATHERS TREASURES DEPOSITED IN SOME EUROPEAN COUNTRIES,HENCE MY MOTHER,MRS.MARY SESE-SEKO AND I ALONG WITH MY BROTHERS BENSON AND BASHER DECIDED LAYING LOW IN AFRICA TO STUDY THE SITUATION TILL WHEN THINGS GETS BETTER,SINCE PRESIDENT KABILA IS DEAD AND THE SON TAKING OVER GOVERNMENT (JOSEPH KABILA). ONE OF MY FATHERS CHATEAU IN SOUTHERN FRANCE WAS CONFISCATED BY THE FRENCH GOVERNMENT,AND AS SUCH WE HAD TO CHANGE OUR IDENTITY SO THAT OUR INVESTMENT WILL NOT BE TRACED AND CONFISCATED.MY MOTHER HAVE DEPOSITED THE SUM OF THIRTY MILLION,FIVE HUNDRED THOUSAND UNITED STATES DOLLARS(US$30,500,000)WITH A SECURITY COMPANY FOR SAFEKEEPING. THE FUNDS ARE SECURITY CODED TO PREVENT THEM FROM KNOWING THE CONTENTS.WHAT I WANT YOU TO DO NOW IS TO INDICATE YOUR INTEREST THAT YOU WILL ASSIST US BY RECEIVING THE MONEY ON OUR BEHALF. THE ACCOUNT REQUIRED FOR THIS PROJECT CAN EITHER BE PERSONAL,COMPANY OR AN OFFSHORE ACCOUNT THAT YOU HAVE TOTAL CONTROL OVER,YOUR AREA OF SPECIALISATION WILL NOT BE A HINDERANCE TO THE SUCCESSFUL EXECUTION OF THIS TRANSACTION.ACKOWLEDGE THIS MESSAGE,SO THAT I CAN INTRODUCE YOU TO MY FAMILY AS OUR FOREIGN TRUSTED PARTNER WHO SHALL TAKE CHARGE OF OUR INVESTMENT ABROAD WHERE WE NOW PLAN TO SETTLE. I WANT YOU TO ASSIST US IN INVESTING THIS MONEY,BUT I WILL NOT WANT OUR IDENTITY REVEALED.I WILL ALSO WANT TO BUY PROPERTIES AND STOCKS IN MULTI-NATIONAL COMPANIES AND TO ENGAGE IN OTHER SAFE AND NON SPECULATIVE INVESTMENTS. WE HAVE BEEN THROUGH A LOT OF HEALTH AND SPIRITUAL TURMOIL,HENCE WILL NEED YOUR UNDERSTANDING AND ASSISTANCE.MAY I AT THIS POINT EMPHASIZE THE HIGH LEVEL OF CONFIDENTIALLITY WHICH THIS BUSINESS DEMANDS AND HOPE YOU WILL NOT BETRAY THE TRUST AND CONFIDENCE WHICH WE REPOSE IN YOU.I SHALL PUT YOU IN THE PICTURE OF THIS BUSINESS,I.E TELL YOU WHERE THE FUNDS ARE CURRENTLY BEING MAINTAINED AND ALSO DISCUSS OTHER MODALITIES INCLUDING REMUNERATION FOR YOUR SERVICES. IS THIS PROPOSITION ATTAINABLE?IF IT IS,PLEASE KINDLY FURNISH ME IMMEDIATELY BY E-MAIL WITH YOUR DIRECT TELEPHONE AND FAX NUMBERS TO ENHANCE THE CONFIDENTIALLITY WHICH THIS BUSINESS DEMANDS. BEST REGARDS MR.KENNETH MOBUTU.SESE SEKO. FOR FAMILY. N.B. REPLY TO:kmosse@myself.com

1 0

A CRY FOR HELP
by KENNETH MOBUTU SESE SEKO 29 Sep '02

29 Sep '02

DEAR FRIEND THROUGH THE COURTESY OF BUSINESS OPPORTUNITY, I TAKE LIBERTY ANCHORED ON A STRONG DESIRE TO SOLICIT YOUR ASSISTANCE ON THIS MUTUALLY BENEFICIAL AND RISKFREE TRANSACTION WHICH I HOPE YOU WILL GIVE YOUR URGENT ATTENTION. I AM MR.KENNETH MOBUTU SESE-SEKO,SON OF LATE PRESIDENT MOBUTU SESE- SEKO OF ZAIRE NOW KNOWN AS DEMOCRATIC REPUBLIC OF CONGO(DRC). I AM MOVED TO WRITE YOU THIS LETTER ,THIS WAS IN CONFIDENCE CONSIDERING OUR PRESENT CIRCUMSTANCE AND SITUATION. I ESCAPED WITH MY FATHER AND MOTHER ALONG WITH TWO OF MY BROTHERS BENSON AND BASHER OUT OF DEMOCRATIC REPUBLIC OF CONGO(DRC)TO ABIDJAN, COTE D'IVOIRE WHERE MY FAMILY AND I SETTLED, WHILE WE LATER MOVED TO SETTLE IN MORROCO WHERE MY FATHER LATER DIED OF CANCER DISEASE.SINCE THE DEATH OF MY LATE FATHER SOME YEARS AGO WE HAVE BEEN RESIDING IN GHANA ON TEMPORARY POLITICAL ASYLUM. HOWEVER DUE TO THIS SITUATION WE DECIDED TO CHANGE MOST OF MY FATHERS BILLIONS OF DOLLARS DEPOSITED IN SWISS BANK AND OTHER COUNTRIES INTO OTHER FORMS OF MONEY CODED FOR SAFE PURPOSE BECAUSE THE NEW HEAD OF STATES(DR.)MR.LAURENT KABILA MADE ARRANGEMENTS WITH THE SWISS GOVERNMENT AND OTHER EUROPEAN COUNTRIES TO FREEZE ALL MY LATE FATHERS TREASURES DEPOSITED IN SOME EUROPEAN COUNTRIES,HENCE MY MOTHER,MRS.MARY SESE-SEKO AND I ALONG WITH MY BROTHERS BENSON AND BASHER DECIDED LAYING LOW IN AFRICA TO STUDY THE SITUATION TILL WHEN THINGS GETS BETTER,SINCE PRESIDENT KABILA IS DEAD AND THE SON TAKING OVER GOVERNMENT (JOSEPH KABILA). ONE OF MY FATHERS CHATEAU IN SOUTHERN FRANCE WAS CONFISCATED BY THE FRENCH GOVERNMENT,AND AS SUCH WE HAD TO CHANGE OUR IDENTITY SO THAT OUR INVESTMENT WILL NOT BE TRACED AND CONFISCATED.MY MOTHER HAVE DEPOSITED THE SUM OF THIRTY MILLION,FIVE HUNDRED THOUSAND UNITED STATES DOLLARS(US$30,500,000)WITH A SECURITY COMPANY FOR SAFEKEEPING. THE FUNDS ARE SECURITY CODED TO PREVENT THEM FROM KNOWING THE CONTENTS.WHAT I WANT YOU TO DO NOW IS TO INDICATE YOUR INTEREST THAT YOU WILL ASSIST US BY RECEIVING THE MONEY ON OUR BEHALF. THE ACCOUNT REQUIRED FOR THIS PROJECT CAN EITHER BE PERSONAL,COMPANY OR AN OFFSHORE ACCOUNT THAT YOU HAVE TOTAL CONTROL OVER,YOUR AREA OF SPECIALISATION WILL NOT BE A HINDERANCE TO THE SUCCESSFUL EXECUTION OF THIS TRANSACTION.ACKOWLEDGE THIS MESSAGE,SO THAT I CAN INTRODUCE YOU TO MY FAMILY AS OUR FOREIGN TRUSTED PARTNER WHO SHALL TAKE CHARGE OF OUR INVESTMENT ABROAD WHERE WE NOW PLAN TO SETTLE. I WANT YOU TO ASSIST US IN INVESTING THIS MONEY,BUT I WILL NOT WANT OUR IDENTITY REVEALED.I WILL ALSO WANT TO BUY PROPERTIES AND STOCKS IN MULTI-NATIONAL COMPANIES AND TO ENGAGE IN OTHER SAFE AND NON SPECULATIVE INVESTMENTS. WE HAVE BEEN THROUGH A LOT OF HEALTH AND SPIRITUAL TURMOIL,HENCE WILL NEED YOUR UNDERSTANDING AND ASSISTANCE.MAY I AT THIS POINT EMPHASIZE THE HIGH LEVEL OF CONFIDENTIALLITY WHICH THIS BUSINESS DEMANDS AND HOPE YOU WILL NOT BETRAY THE TRUST AND CONFIDENCE WHICH WE REPOSE IN YOU.I SHALL PUT YOU IN THE PICTURE OF THIS BUSINESS,I.E TELL YOU WHERE THE FUNDS ARE CURRENTLY BEING MAINTAINED AND ALSO DISCUSS OTHER MODALITIES INCLUDING REMUNERATION FOR YOUR SERVICES. IS THIS PROPOSITION ATTAINABLE?IF IT IS,PLEASE KINDLY FURNISH ME IMMEDIATELY BY E-MAIL WITH YOUR DIRECT TELEPHONE AND FAX NUMBERS TO ENHANCE THE CONFIDENTIALLITY WHICH THIS BUSINESS DEMANDS. BEST REGARDS MR.KENNETH MOBUTU.SESE SEKO. FOR FAMILY. N.B. REPLY TO:kmosse@myself.com

1 0

A CRY FOR HELP
by KENNETH MOBUTU SESE SEKO 29 Sep '02

29 Sep '02

DEAR FRIEND THROUGH THE COURTESY OF BUSINESS OPPORTUNITY, I TAKE LIBERTY ANCHORED ON A STRONG DESIRE TO SOLICIT YOUR ASSISTANCE ON THIS MUTUALLY BENEFICIAL AND RISKFREE TRANSACTION WHICH I HOPE YOU WILL GIVE YOUR URGENT ATTENTION. I AM MR.KENNETH MOBUTU SESE-SEKO,SON OF LATE PRESIDENT MOBUTU SESE- SEKO OF ZAIRE NOW KNOWN AS DEMOCRATIC REPUBLIC OF CONGO(DRC). I AM MOVED TO WRITE YOU THIS LETTER ,THIS WAS IN CONFIDENCE CONSIDERING OUR PRESENT CIRCUMSTANCE AND SITUATION. I ESCAPED WITH MY FATHER AND MOTHER ALONG WITH TWO OF MY BROTHERS BENSON AND BASHER OUT OF DEMOCRATIC REPUBLIC OF CONGO(DRC)TO ABIDJAN, COTE D'IVOIRE WHERE MY FAMILY AND I SETTLED, WHILE WE LATER MOVED TO SETTLE IN MORROCO WHERE MY FATHER LATER DIED OF CANCER DISEASE.SINCE THE DEATH OF MY LATE FATHER SOME YEARS AGO WE HAVE BEEN RESIDING IN GHANA ON TEMPORARY POLITICAL ASYLUM. HOWEVER DUE TO THIS SITUATION WE DECIDED TO CHANGE MOST OF MY FATHERS BILLIONS OF DOLLARS DEPOSITED IN SWISS BANK AND OTHER COUNTRIES INTO OTHER FORMS OF MONEY CODED FOR SAFE PURPOSE BECAUSE THE NEW HEAD OF STATES(DR.)MR.LAURENT KABILA MADE ARRANGEMENTS WITH THE SWISS GOVERNMENT AND OTHER EUROPEAN COUNTRIES TO FREEZE ALL MY LATE FATHERS TREASURES DEPOSITED IN SOME EUROPEAN COUNTRIES,HENCE MY MOTHER,MRS.MARY SESE-SEKO AND I ALONG WITH MY BROTHERS BENSON AND BASHER DECIDED LAYING LOW IN AFRICA TO STUDY THE SITUATION TILL WHEN THINGS GETS BETTER,SINCE PRESIDENT KABILA IS DEAD AND THE SON TAKING OVER GOVERNMENT (JOSEPH KABILA). ONE OF MY FATHERS CHATEAU IN SOUTHERN FRANCE WAS CONFISCATED BY THE FRENCH GOVERNMENT,AND AS SUCH WE HAD TO CHANGE OUR IDENTITY SO THAT OUR INVESTMENT WILL NOT BE TRACED AND CONFISCATED.MY MOTHER HAVE DEPOSITED THE SUM OF THIRTY MILLION,FIVE HUNDRED THOUSAND UNITED STATES DOLLARS(US$30,500,000)WITH A SECURITY COMPANY FOR SAFEKEEPING. THE FUNDS ARE SECURITY CODED TO PREVENT THEM FROM KNOWING THE CONTENTS.WHAT I WANT YOU TO DO NOW IS TO INDICATE YOUR INTEREST THAT YOU WILL ASSIST US BY RECEIVING THE MONEY ON OUR BEHALF. THE ACCOUNT REQUIRED FOR THIS PROJECT CAN EITHER BE PERSONAL,COMPANY OR AN OFFSHORE ACCOUNT THAT YOU HAVE TOTAL CONTROL OVER,YOUR AREA OF SPECIALISATION WILL NOT BE A HINDERANCE TO THE SUCCESSFUL EXECUTION OF THIS TRANSACTION.ACKOWLEDGE THIS MESSAGE,SO THAT I CAN INTRODUCE YOU TO MY FAMILY AS OUR FOREIGN TRUSTED PARTNER WHO SHALL TAKE CHARGE OF OUR INVESTMENT ABROAD WHERE WE NOW PLAN TO SETTLE. I WANT YOU TO ASSIST US IN INVESTING THIS MONEY,BUT I WILL NOT WANT OUR IDENTITY REVEALED.I WILL ALSO WANT TO BUY PROPERTIES AND STOCKS IN MULTI-NATIONAL COMPANIES AND TO ENGAGE IN OTHER SAFE AND NON SPECULATIVE INVESTMENTS. WE HAVE BEEN THROUGH A LOT OF HEALTH AND SPIRITUAL TURMOIL,HENCE WILL NEED YOUR UNDERSTANDING AND ASSISTANCE.MAY I AT THIS POINT EMPHASIZE THE HIGH LEVEL OF CONFIDENTIALLITY WHICH THIS BUSINESS DEMANDS AND HOPE YOU WILL NOT BETRAY THE TRUST AND CONFIDENCE WHICH WE REPOSE IN YOU.I SHALL PUT YOU IN THE PICTURE OF THIS BUSINESS,I.E TELL YOU WHERE THE FUNDS ARE CURRENTLY BEING MAINTAINED AND ALSO DISCUSS OTHER MODALITIES INCLUDING REMUNERATION FOR YOUR SERVICES. IS THIS PROPOSITION ATTAINABLE?IF IT IS,PLEASE KINDLY FURNISH ME IMMEDIATELY BY E-MAIL WITH YOUR DIRECT TELEPHONE AND FAX NUMBERS TO ENHANCE THE CONFIDENTIALLITY WHICH THIS BUSINESS DEMANDS. BEST REGARDS MR.KENNETH MOBUTU.SESE SEKO. FOR FAMILY. N.B. REPLY TO:kmosse@myself.com

1 0

1.52 Solaris didn't include -lresov
by Lancashire, Pete 27 Sep '02

27 Sep '02

Hi, syslog-ng(a)lists.balabit.hu New to the list so don't know if this is new or not the 1.5.12 configure does not add -lresolv to the list of required lib's and not in the 'warning' list of bugs, gcc 3.0.3 gcc -DHAVE_CONFIG_H -I. -I/usr/local/tmp/syslog-ng-1.5.21/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c main.c main.c: In function `main': main.c:438: warning: passing arg 2 of `resolve_user_group' from incompatible pointer type main.c:438: warning: passing arg 3 of `resolve_user_group' from incompatible pointer type main.c:442: warning: passing arg 2 of `resolve_group' from incompatible pointer type gcc -DHAVE_CONFIG_H -I. -I/usr/local/tmp/syslog-ng-1.5.21/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c center.c center.c: In function `do_distribute_log': center.c:157: warning: deprecated use of label at end of compound statement gcc -DHAVE_CONFIG_H -I. -I/usr/local/tmp/syslog-ng-1.5.21/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c filters.c filters.c: In function `do_filter_call': filters.c:342: warning: implicit declaration of function `memcmp' and in src/test testall use /bin/sh but uses bash features export SYSLOG_NG=../syslog-ng export LOGGER=logger for file in test.*; do ./$file done the export's have to be on seporate lines for sh, but are ok for bash the tests use logger -u, the version of logger I have is from solaris 5.8, it does not have a -u option. -pete

1 0

Linking error
by Aaron Jackson 27 Sep '02

27 Sep '02

I just downloaded syslog-ng-1.5.21 and libol 0.3.3 and tried to compile them on a Solaris 8 gcc 2.95 system. The build process stops with the following error: gcc -DHAVE_CONFIG_H -I. -I/export/home/jackson/syslog-ng-1.5.21/src -I. -g - O2 -Wall -I/export/home/jackson/libol-0.3.3/src -D_GNU_SOURCE -c getopt1.c gcc -g -O2 -Wall -I/export/home/jackson/libol-0.3.3/src -D_GNU_SOURCE -o syslo g-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-gr ammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afst reams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getop t1.o -lpthread -ldoor -lfl /export/home/jackson/libol-0.3.3/src/.libs/libol.a - lsocket -lnsl -lxnet Undefined first referenced symbol in file res_init main.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /export/home/jackson/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /export/home/jackson/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /export/home/jackson/syslog-ng-1.5.21/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' I did a man res_init, and it appears that this function is a resolver library function. So I added -lresolv to the Makefile and everything compiled OK. Aaron Jackson

1 0

use_time_recvd
by Trapp, Michael 27 Sep '02

27 Sep '02

hi bazsi, i was a little bit surprised about the use_time_recvd option. obviously it has no impact on the timestamp of a recieved msg if there is already a timestamp included. i thought that the recvd-timestamp is used anyway ... well, i've attached a patch to fix that. regards michael

1 0

crash version 1.5.20 under stress with tcp
by Puschmann Johannes 26 Sep '02

26 Sep '02

Hi List. I am testing syslog-ng 1.5.20. Its an RH 7.2 kernel 2.4.18 syslog-ng was compiled from source. When you flood the machine with messages over tcp, it crashes Under udp port 514 its looks nice. (20000 messages/min no Problem) see Backtrace and configfile below. Looks like the template makes problems. best regards Johannes gc_mark: Marking object of class 'UNKNOWN' (1) AF_INET client connected from 192.168.129.102, port 1609 io.c: Preparing fd 8 for reading 192.168.129.102... adding as 707 (1 iters). io.c: Preparing fd 9 for writing io.c: Preparing fd 10 for writing Program received signal SIGSEGV, Segmentation fault. 0x080526a0 in expand_macros (cfg=0x6f6c7379, template=0x65742067, template_escape=1830843507, msg=0x61737365) at affile.c:866 866 while (left && (i < template->length)) { (gdb) bt #0 0x080526a0 in expand_macros (cfg=0x6f6c7379, template=0x65742067, template_escape=1830843507, msg=0x61737365) at affile.c:866 #1 0x53207369 in ?? () Cannot access memory at address 0x20736968 ------------------------------------------------------------------- options { dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname(yes); }; source local { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); internal(); }; # *.* @192.168.129.164 filter f_1 { level(debug...emerg); }; #destination d_1 { # udp("192.168.129.164" port(514)); #}; #log { source(local); filter(f_1); destination(d_1); }; # *.info;mail.none;news.none;authpriv.none;cron.none;daemon.none /var/log/messages filter f_2 { not facility(authpriv); }; filter f_3 { not facility(cron); }; filter f_4 { not facility(daemon); }; filter f_5 { level(info...emerg); }; filter f_6 { not facility(mail); }; filter f_7 { not facility(news); }; destination d_2 { file("/var/log/messages" create_dirs(yes)); }; log { source(local); filter(f_2); filter(f_3); filter(f_4); filter(f_5); filter(f_6); filter(f_7); destination(d_2); }; # authpriv.* /var/log/secure filter f_8 { facility(authpriv) and level(debug...emerg); }; destination d_3 { file("/var/log/secure" create_dirs(yes)); }; log { source(local); filter(f_8); destination(d_3); }; # daemon.* /var/log/daemon filter f_9 { facility(daemon) and level(debug...emerg); }; destination d_4 { file("/var/log/daemon" create_dirs(yes)); }; log { source(local); filter(f_9); destination(d_4); }; # mail.* /var/log/maillog filter f_10 { facility(mail) and level(debug...emerg); }; destination d_5 { file("/var/log/maillog" create_dirs(yes)); }; log { source(local); filter(f_10); destination(d_5); }; # cron.* /var/log/cron filter f_11 { facility(cron) and level(debug...emerg); }; destination d_6 { file("/var/log/cron" create_dirs(yes)); }; log { source(local); filter(f_11); destination(d_6); }; # *.emerg * filter f_12 { level(emerg); }; destination d_7 { usertty("*"); }; log { source(local); filter(f_12); destination(d_7); }; # uucp,news.crit /var/log/spooler filter f_13 { facility(uucp,news) and level(crit...emerg); }; destination d_8 { file("/var/log/spooler" create_dirs(yes)); }; log { source(local); filter(f_13); destination(d_8); }; # local7.* /var/log/boot.log filter f_14 { facility(local7) and level(debug...emerg); }; destination d_9 { file("/var/log/boot.log" create_dirs(yes)); }; log { source(local); filter(f_14); destination(d_9); }; # news.=crit /var/log/news/news.crit filter f_15 { facility(news) and level(crit...emerg); }; destination d_10 { file("/var/log/news/news.crit" create_dirs(yes)); }; log { source(local); filter(f_15); destination(d_10); }; # news.=err /var/log/news/news.err filter f_16 { facility(news) and level(err...emerg); }; destination d_11 { file("/var/log/news/news.err" create_dirs(yes)); }; log { source(local); filter(f_16); destination(d_11); }; # news.notice /var/log/news/news.notice filter f_17 { facility(news) and level(notice...emerg); }; destination d_12 { file("/var/log/news/news.notice" create_dirs(yes)); }; log { source(local); filter(f_17); destination(d_12); }; ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(local); destination(d_mysql); }; [root@test src]#

1 0

dns_cache problems with v1.5.13
by colm ennis 26 Sep '02

26 Sep '02

hi all, im currently using syslog-ng version 1.5.13. i have experienced problems where negatively cached records were preserved indefinitely. only a full restart would cause these ips to be resolved, even a hup would fail. i've now turned off caching cos we rely on ips being resolved in these log files. impt part of the config attached, thanks, colm -- options { sync(0); log_fifo_size(1000); use_dns(yes); dns_cache(yes); use_fqdn(yes); chain_hostnames(no); };

2 2

Re: [syslog-ng]MYSQL problem
by Michael Earls 25 Sep '02

25 Sep '02

What ver of syslog-ng are u running? The dbName, dbPassword, and dbUsername are stored in the script and that script then takes the input from the mysql.pipe, or from the command line mysql -u root --password=passwd syslog < /tmp/mysql.pipe Look the scripts,, http://www.vermeer.org/syslog/scripts michael >>> cat_roger22(a)hotmail.com 09/24/02 08:13AM >>> Hi *, I didn't understood the posts on the mailing list about the entryes inserted into syslog-db, I've some questions: destination d_mysql { pipe("/var/chroot/syslog-ng/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template_escape(yes)); }; I verified the conf file with "-s" option and it didn't returned any error. The Db works fine and I noticed that other people have the same problem...What is the solution ? ...And... Where is set the DB name variable ?...in a conf file I suppose....but where is that ? I Activated the debug option but the output was : gc_mark: Marking object of class 'UNKNOWN' (1) I see the same output even if I don't use mysql option.... Ciao _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

MYSQL problem
by _/CaT\_ 24 Sep '02

24 Sep '02

Hi *, I didn't understood the posts on the mailing list about the entryes inserted into syslog-db, I've some questions: destination d_mysql { pipe("/var/chroot/syslog-ng/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template_escape(yes)); }; I verified the conf file with "-s" option and it didn't returned any error. The Db works fine and I noticed that other people have the same problem...What is the solution ? ...And... Where is set the DB name variable ?...in a conf file I suppose....but where is that ? I Activated the debug option but the output was : gc_mark: Marking object of class 'UNKNOWN' (1) I see the same output even if I don't use mysql option.... Ciao

1 0

RE: [syslog-ng]syslog-ng on Solaris 9
by Hamilton, Andrew 20 Sep '02

20 Sep '02

Fritz, Make sure you don't have anything else bound to that port. Regular syslog uses it and snmpd will sometimes use it. Try kicking off "syslog-ng -dv" and see what the error is. It may tell you that something is bound there already. Regards, Drew -----Original Message----- From: Fritz Buetikofer [mailto:Fritz.Buetikofer@id.unibe.ch] Sent: Friday, September 20, 2002 8:39 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng on Solaris 9 Dear all I'm currently testing syslog-ng 1.5.20 on a new Solaris 9 server. When starting up the daemon, it does not bind on the UDP port 514, so network syslog packets are not processed. Any idea what I did wrong ? Thanks and best regards, --Fritz. ============= University of Bern Computer Services Dept. Fritz Buetikofer. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng on Solaris 9
by Fritz Buetikofer 20 Sep '02

20 Sep '02

Dear all I'm currently testing syslog-ng 1.5.20 on a new Solaris 9 server. When starting up the daemon, it does not bind on the UDP port 514, so network syslog packets are not processed. Any idea what I did wrong ? Thanks and best regards, --Fritz. ============= University of Bern Computer Services Dept. Fritz Buetikofer.

1 0

register
by Fritz Buetikofer 20 Sep '02

20 Sep '02

register btkfr(a)id.unibe.ch

1 0

RE: [syslog-ng]missing 33% of syslog messages
by Hamilton, Andrew 19 Sep '02

19 Sep '02

Bob, Have you checked to see that the messages are getting to the loghost? On a busy network it is possible to lose a number of packets. With UDP you never know. You could use a network sniffer to find out. Something else you might try is raising sync some. If you are getting a ton of messages you might be getting lost in I/O somewhere. sync(0) writes immediately so you might crank it up a little to get some buffering going. You might have to play around with some of the options to get it to work with your configuration. I believe that stats are where you have the internal source going. It is just a line in the file I think. Regards, Drew -----Original Message----- From: Bob Kupiec [mailto:kupiec@ias.edu] Sent: Thursday, September 19, 2002 12:25 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]missing 33% of syslog messages I'm running syslog-ng 1.4.14 on Linux. This server is a loghost for all my syslog clients. It's got plenty of cpu, memory, disk, and bandwidth. The servers that it's accepting logs from are on the same switch as the loghost. That said, I'm losing about 33% of my syslog messages from each client. I tried 1.5.20 with the slightly worse results. All the clients are UDP, and need to stay that way. There are times when minutes go by without recording anything from the clients. Also, where are the "stats" recorded to? Here is my config: ---------------------------------------------------------------------------- options { sync (0); time_reopen (10); # Increased buffer size to 50*256 (50 hosts). -rjk log_fifo_size (12800); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); stats (600); owner (root); group (syslog); perm (0644); dir_owner (root); dir_group (syslog); dir_perm (0755); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/lo g"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; destination remote { file("/var/log/remote/$HOST/$FACILITY.log" log_fifo_size (12800)); }; source net { udp(); }; log { source(net); destination(remote); }; ---------------------------------------------------------------------------- -- Bob Kupiec Security/Network Administrator Email: kupiec(a)ias.edu Institute for Advanced Study Phone: 609-734-8179 Einstein Drive (A208) Fax: 609-951-4418 Princeton, NJ 08540-4907 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

missing 33% of syslog messages
by Bob Kupiec 19 Sep '02

19 Sep '02

I'm running syslog-ng 1.4.14 on Linux. This server is a loghost for all my syslog clients. It's got plenty of cpu, memory, disk, and bandwidth. The servers that it's accepting logs from are on the same switch as the loghost. That said, I'm losing about 33% of my syslog messages from each client. I tried 1.5.20 with the slightly worse results. All the clients are UDP, and need to stay that way. There are times when minutes go by without recording anything from the clients. Also, where are the "stats" recorded to? Here is my config: ---------------------------------------------------------------------------- options { sync (0); time_reopen (10); # Increased buffer size to 50*256 (50 hosts). -rjk log_fifo_size (12800); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); stats (600); owner (root); group (syslog); perm (0644); dir_owner (root); dir_group (syslog); dir_perm (0755); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/lo g"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; destination remote { file("/var/log/remote/$HOST/$FACILITY.log" log_fifo_size (12800)); }; source net { udp(); }; log { source(net); destination(remote); }; ---------------------------------------------------------------------------- -- Bob Kupiec Security/Network Administrator Email: kupiec(a)ias.edu Institute for Advanced Study Phone: 609-734-8179 Einstein Drive (A208) Fax: 609-951-4418 Princeton, NJ 08540-4907

1 0

question about logrotate (little offtopic ;)
by Buerger, Manfred 19 Sep '02

19 Sep '02

hello, my syslog-ng server is runnig fine, but a have little problem with logrotate. please take a look... syslog-ng writes the log files into "/var/log/syslog-ng/" in this directory for each host a subdirectory is created e.g.: /var/log/syslog-ng/10.10.10.2/ /var/log/syslog-ng/10.10.10.3/ usw... in /etc/logrotate.conf i made the following entry: /var/log/syslog-ng/* { rotate 5 daily size=500M postrotate /usr/bin/killall -HUP syslog-ng endscript compress } but this dont work! i have to specify the whole path to the log files: /var/log/syslog-ng/10.10.10.3/* ist there a way to rotate a directory with its subdirectory?? thanks in advance manfred

1 0