- syslog-ng - lists.balabit.hu

Re: [syslog-ng]hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 11 Apr '02

11 Apr '02

Hmm OK, how should I set the permissions of the file? Thanks, Bret Balazs Scheidler <bazsi(a)balabit.hu> 11/04/2002 03:26 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: (bcc: WATSON Bret/IT/CHRT/ST Group) Subject: Re: [syslog-ng]hosts... today's stupid question :} On Thu, Apr 11, 2002 at 08:18:51AM +0800, bretwatson(a)charteredsemi.com wrote: > Hi Bazsi, > but it is listed as a valid macro and digging through the code it is > actually there as in the macroexpansion proc... > > does that mean not all macro identifiers are currently being expanded? > Which ones are valid? > > destination host { file("/usr/log1/$HOST/$YEAR$MONTH$DAY" owner(root) group(logusers) perm(0640) dir_perm(0755)); }; ^^^^ macros are not reserved words, I meant the name of your destination. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Re: [syslog-ng]hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 11 Apr '02

11 Apr '02

Hi Bazsi, but it is listed as a valid macro and digging through the code it is actually there as in the macroexpansion proc... does that mean not all macro identifiers are currently being expanded? Which ones are valid? Cheers Bret Balazs Scheidler <bazsi(a)balabit.hu> 10/04/2002 05:26 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: (bcc: WATSON Bret/IT/CHRT/ST Group) Subject: Re: [syslog-ng]hosts... today's stupid question :} On Wed, Apr 10, 2002 at 08:22:26AM +0800, bretwatson(a)charteredsemi.com wrote: > > Hi All, > a stupid question most probably, > I'd like to build a generic destination for my default filter so that any > new hosts get dropped into their own directory > > something like > destination host { file("/usr/log1/$HOST/$YEAR$MONTH$DAY" owner(root) > group(logusers) perm(0640) dir_perm(0755)); }; > > But syslog-ng doesn't seem to like it and complains of syntax errors all > the time.. host is a reserved word, don't use it for identifiers. the best bet is to prefix identifiers with the purpose, e.g. d_host for destination f_host for filters and so on. It will not collide with reserved words then. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

2 1

Re: [syslog-ng]hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 11 Apr '02

11 Apr '02

hmm must have been a typo somewhere in the command - I started afresh and now it works :} Cheers, Bret [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

1 0

[PATCH] Unixtime (again)
by Gert Menke 10 Apr '02

10 Apr '02

Hi! Here's my Unixtime-Patch again, this time against syslog-ng-1.5.15. Balazs, I understand that you don't have much time, but please tell me what you think of it and if you will include it in 1.5.16, or why you won't. Also, I would like to have an option do define one or more default templates, perhaps like this: template t_unixtime { "$S_UNIXTIME $R_UNIXTIME $SOURCEIP $HOST $MSG\n" }; template t_isotime { "$S_ISOTIME $R_ISOTIME $SOURCEIP $HOST $MSG\n" }; destination d_foo { file("foo.log"); template(t_unixtime); }; destination d_bar { file("bar.log"); template(t_unixtime); }; destination d_human-readable { file("human-readable.log"); template(t_isotime); }; How can I do this? Could you help me implementing it? Greetings Gert

1 0

hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 10 Apr '02

10 Apr '02

Hi All, a stupid question most probably, I'd like to build a generic destination for my default filter so that any new hosts get dropped into their own directory something like destination host { file("/usr/log1/$HOST/$YEAR$MONTH$DAY" owner(root) group(logusers) perm(0640) dir_perm(0755)); }; But syslog-ng doesn't seem to like it and complains of syntax errors all the time.. Any hints? Thanks, Bret [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

2 1

RE: Passing IP address to a program
by Kevin Welch 09 Apr '02

09 Apr '02

Ignore that, its early. -----Original Message----- From: Kevin Welch Sent: Tuesday, April 09, 2002 8:04 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: Passing IP address to a program When my log events come in, I want to pass some of them to an external program to e-mail them, since the log event does not contain the ip address of the host, is there a way to pass this information along with the syslog event? -- Kevin

1 0

Passing IP address to a program
by Kevin Welch 09 Apr '02

09 Apr '02

When my log events come in, I want to pass some of them to an external program to e-mail them, since the log event does not contain the ip address of the host, is there a way to pass this information along with the syslog event? -- Kevin

1 0

Secondary date code
by Kevin Welch 08 Apr '02

08 Apr '02

All my syslog events have two date codes, is there any way to stop this? Apr 8 15:11:29 208.224.0.252 32200: Apr 8 14:11:28.307 EST: %SYS-5-CONFIG_I: Configured from console by vty1 (206.114.47.144) -- Kevin

1 0

RE: [syslog-ng]syslog-ng
by Michael Earls 08 Apr '02

08 Apr '02

i never ran into that problem on debian, i did have have it working to log to mysql,. but i was using mysql / pipe to enter stuff in the table, but the mysql client would die, for some unknow reason, that is why i am looking at a differnet way to set it up, and i need advise/help thanks michael www.vermeer.org -----Original Message----- From: AGehring(a)bis.adp.com Sent: Monday, April 08, 2002 2:28 PM To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> Subject: RE: [syslog-ng]syslog-ng I don't see how adding the ability for syslog ng to write to a database (SQL based) is any more different/difficult the allowing it to write to a file... We've modified it to natively write to Sybase... The problem with external programs, at least in our case, was that we would end up having 20+ process running to get the data where we needed it.... Andrew

1 0

RE: [syslog-ng]syslog-ng
by Gehring, Andrew x66132 08 Apr '02

08 Apr '02

I don't see how adding the ability for syslog-ng to write to a database (SQL based) is any more different/difficult the allowing it to write to a file... We've modified it to natively write to Sybase... The problem with external programs, at least in our case, was that we would end up having 20+ process running to get the data where we needed it.... Andrew

1 0

RE: [syslog-ng]syslog-ng
by Michael Earls 08 Apr '02

08 Apr '02

The reason I want it to log to a database is that I have over 100 routers and switches in different cities, I want a central Syslog server, I want all of techs in each city to be able to view the Syslog messages from a web browser anywhere. The only way I know to do this is have Syslog log to some database then have php/perl search from the web. What is the best way for me to do this with Syslog-ng? thanks michael -----Original Message----- From: bazsi(a)balabit.hu Sent: Wednesday, April 03, 2002 4:55 AM To: <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng]syslog-ng On Wed, Apr 03, 2002 at 03:38:03AM 0500, Michael Earls wrote: > Will syslog ng ever be native to log to mysql or any other type of > external database? I don't understand what the problems with using an external program for such purpose are. Simply write a 10 line long perl script where you can even preprocess messages before they go to the database, and feed this script with a pipe/program destination. Adding support for pgsql/mysql/sybase/whatever into syslog ng is bloat in my opinion. Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog ng maillist syslog ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog ng

1 0

RE: [syslog-ng]syslog-ng
by Michael Earls 08 Apr '02

08 Apr '02

the ver of syslog-ng 1.5.15, does it support templates? i can not get this line to work in this ver,, ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; is there a debug mode and where does that debug file go? thanks michael

1 0

io.c: do_write: write() failed (errno 146), Connection refused
by Vaningh, Ronny 08 Apr '02

08 Apr '02

My syslog-ng sometimes dies with the following message Apr 8 11:20:02 local@loghost syslog-ng[18617]: io.c: do_write: write() failed (errno 146), Connection refused I`m writing to a file on a local disk and forwarding over udp to a plain unix syslog server destination pix { file("/prod/log/$HOST/pix.log" create_dirs(yes) ); }; destination blah { udp(1.2.3.4); }; # # Lets chain everything together # log { source(net); filter(f_pix); destination(pix); destination(blah); }; Any idea what is causing this Thanks Ronny

1 0

RE: Filter Question.
by Kevin Welch 04 Apr '02

04 Apr '02

I fixed it.... after I found the link to the archives, I managed to figure out that the ; makes a big difference. -- Kevin -----Original Message----- From: Kevin Welch Sent: Thursday, April 04, 2002 2:57 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: Filter Question. Im trying to setup a filter as follows: filter f_terse { facility(local7); and match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; filter f_notterse { facility(local7); and not match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; Now my problem is that this doesnt work and kicks back an error, it seems I cannot use the match keyword and define other parameters. Is this correct or do I have the syntax messed up? My reason for needing this is that terse call records from my my dial systems take over 10000 calls a day and generate alot of syslog information, I need a way to filter these to a different logfile from other syslog events. Thanks -- Kevin

1 0

Filter Question.
by Kevin Welch 04 Apr '02

04 Apr '02

Im trying to setup a filter as follows: filter f_terse { facility(local7); and match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; filter f_notterse { facility(local7); and not match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; Now my problem is that this doesnt work and kicks back an error, it seems I cannot use the match keyword and define other parameters. Is this correct or do I have the syntax messed up? My reason for needing this is that terse call records from my my dial systems take over 10000 calls a day and generate alot of syslog information, I need a way to filter these to a different logfile from other syslog events. Thanks -- Kevin

1 0

Newbie questions.
by Stephen Amadei 04 Apr '02

04 Apr '02

Hello. I have been considering changing to syslog-ng for a while now, but I've been unable to wrap my brain around the idea since I don't exactly understand how syslog-ng replaces the old syslog. My first question is just that: How does syslog-ng replace the syslog? Do you simply remove klogd and syslogd from running and run syslog-ng instead? Is there a sample syslog-ng.conf that I can use to approximate the old syslog functionality until I get brave enough to tinker with it myself? My next concern is the "syslog -a" function. Where chrooting programs, I need to create extra /dev/log things by using the -a option. Can Syslog-ng also do this? Does syslog-ng still use the normal /dev/log device? I'm sorry if these are simple questions, but I think I will be pretty well set if I understand how closely to syslog syslog-ng works. ----Steve Stephen Amadei Dandy.NET! CTO Atlantic City, NJ

1 0

syslog-ng
by Michael Earls 03 Apr '02

03 Apr '02

Will syslog-ng ever be native to log to mysql or any other type of external database? thanks michael

3 2

Re: [syslog-ng]syslog-ng
by bretwatson＠charteredsemi.com 03 Apr '02

03 Apr '02

If you really want there is some work on a system that takes syslog on stdin and feeds into a modified snort IDS - thus you can have stateful inspection of content and all sorts of filtering.. look at sourceforge for snortadapter Bret Balazs Scheidler <bazsi(a)balabit.hu> 03/04/2002 05:55 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: (bcc: WATSON Bret/IT/CHRT/ST Group) Subject: Re: [syslog-ng]syslog-ng On Wed, Apr 03, 2002 at 03:38:03AM -0500, Michael Earls wrote: > Will syslog-ng ever be native to log to mysql or any other type of > external database? I don't understand what the problems with using an external program for such purpose are. Simply write a 10 line long perl script where you can even preprocess messages before they go to the database, and feed this script with a pipe/program destination. Adding support for pgsql/mysql/sybase/whatever into syslog-ng is bloat in my opinion. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

1 0

Filtering out multiple entries in log files due to different level
by Nick Chondropoulos 03 Apr '02

03 Apr '02

I just started testing syslog-ng in our enviroment a few days ago. I've been able to do what I want for the most part but the one thing that I'm stuck on (and it's probably a stupid admin trick I've missed) is to remove multiple entries from a log file due to level reporting. The necessary bit of backgound: Solaris 8 10/01 on both the client and server. The config file is: --------------------------------------------------------------------- options { sync(0); time_reopen(10); log_fifo_size(100); keep_hostname (no); chain_hostnames (no); create_dirs (yes); }; source net { udp (); }; destination all_by_host-facility { file ("/var/logs/$HOST/$FACILITY/$YEAR/$HOST.$FACILITY.$YEAR.$MONTH.log"); }; destination all_by_facility { file ("/var/logs/$FACILITY/$YEAR/$MONTH/$FACILITY.$LEVEL.$YEAR.$MONTH.log"); }; log { source(net); destination(all_by_host-facility); destination(all_by_facility); }; --------------------------------------------------------------------- I get the logs to split out by hostname year etc. but I get multiple entries in a log file the higher the level. The idea was to log a facility per file so I expected a single entry in the log file which I guess was a woring assumption. Is there a way to stop the following from happening: client> logger -p auth.emerg EMERG server> tail <log> Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG and replace it with a single line of: Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Is it even a syslog-ng config question? Maybe it's an OS question. TIA Nick -------------------------------+------------------+------------------- Nick Chondropoulos | Schlumberger | ZHTW H ELLAS Senior UNIX Systems Manager | 525 3rd Ave S.W. | nickc(a)calgary.geoquest.slb.com | Calgary, AB | If it's not P) 403-509-4000 | CANADA | dedicated hardware F) 403-509-4170 | T2P 0G4 | it's crap! -------------------------------+------------------+------------------- QUOMODO ARDUUM ESSE POSSIT

2 1

Is there a way to define message priority for syslog-ng?
by Antai Ning 03 Apr '02

03 Apr '02

4 5

(no subject)
by joyce_qian 02 Apr '02

02 Apr '02

syslog-ng，您好！致礼！ joyce_qian joyce_qian(a)mail.ihep.ac.cn

1 0

warning
by John_Delisle＠ceridian.ca 02 Apr '02

02 Apr '02

One thing to watch for in the latest version of syslog-ng - If you create a destination of /dev/null it changes the permissions on /dev/null to 0600 by default. This causes all sorts of problems. Perhaps a warning is in order? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 ********************************************************************** This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege. If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please notify the sender immediately. **********************************************************************

2 1

[PATCH] Unixtime Macros
by Gert Menke 29 Mar '02

29 Mar '02

Hi! The following patch adds the Macros $UNIXTIME, $S_UNIXTIME and $R_UNIXTIME. They give you the time in the internal unix time format (seconds since 1970 or so). Since it is useful for me, it is probably useful for others, too. This patch is against syslog-ng-1.5.14 with my sourceip127-patch (which I posted on 05.Feb.2002), but will also work with the plain syslog-ng-1.5.14 sources (with an offset of -3 lines). Balazs, please include this patch in the next release if you find it useful. Greetings Gert

1 0

templates...
by Dave Patterson 29 Mar '02

29 Mar '02

Hello, has anyone had any luck /w templates <to configure the way syslog-ng writes its log> I'd like to call a template file containing the information if possible. this is my current config: template {date '+%b %e %T' hostname PROGRAM:} destination d_program {file("/var/syslog-ng/$HOST/$PROGRAM/$MONTH_$DAY" perm(0644) compress (yes) template(template)) }; I'm not haveing any luck at all,... any help is apprecated, Thanks Dave Patterson

2 1

RE: [syslog-ng]syslog-ng pix help
by John Coke 28 Mar '02

28 Mar '02

Are you still having problems? I have my pixen logging, I might be able to help. -----Original Message----- From: Steve [mailto:steve_slog_ml@timko.com] Sent: Thursday, March 28, 2002 1:49 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng pix help ok now I got pix.log file collecting info but It seems the pix is sending syslog out to err so messages and console is still logging everything which is ugly.. what am I donig wrong? I tried filter f_not_pix { host(regexp to match host); }; that didn't work.. -steve On Thu, 28 Mar 2002, Steve wrote: > ok I got logging in debug mode working on the pix but now everything is > coming to console and messages.. > > I'm trying to get it just to log to pix.log filename.. > > nothing there.. > > -s > > > On Thu, 28 Mar 2002, Steve wrote: > > > Hello, > > > > I saw this post: > > > > http://lists.balabit.hu/pipermail/syslog-ng/2001-November/002760.html > > > > and I'm kinda having a simular problem, but I can't even get logging to > > work. At one point I had the pix logs going to console... > > > > > > Now I got nothing.. > > > > Heres what I got in syslog-ng.conf > > > > destination pix { file("/var/log/pix.log"); }; > > # > > # host filters > > # > > filter f_pix { host(10.1.5.3); }; > > log { source(src); filter(f_pix); destination(pix); }; > > > > > > Does it matter where you put this lines? > > > > thanks for the help if u can.. > > > > > > oh yea > > > > pix has this enabled: > > > > pixfirewall# show loggi > > Syslog logging: enabled > > Timestamp logging: disabled > > Standby logging: disabled > > Console logging: disabled > > Monitor logging: disabled > > Buffer logging: disabled > > Trap logging: disabled > > History logging: disabled > > > > along with > > > > ogging on > > no logging timestamp > > no logging standby > > no logging console > > no logging monitor > > no logging buffered > > no logging trap > > no logging history > > logging facility 20 > > logging queue 512 > > logging host inside 10.1.5.222 > > > > > > > > thanks for any help > > > > -steve > > > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0