- syslog-ng - lists.balabit.hu

Adding new facilities
by Brad Arlt 01 Aug '01

01 Aug '01

Hello... I am compiling syslog-ng 1.4.12 for Solaris 8, and noticed the IRIX factilities of LOG_AUDIT and LOG_LFMT are not mentioned anywhere in syslog-names.c. Also the facilities of LOG_NTP, LOG_SECURITY, and LOG_CONSOLE from BSD are not mentioned anywhere. I have in the past (and will in this build) manually defined LOG_AUTHPRIV and LOG_FTP for receiving messages from our Linux/BSD machines (AUTHPRIV and FTP are a Linux and BSD thing). If I understand the source code correctly the names are only used to translate configuration file strings to number (e.g. "auth" -> (4<<3)). If I am right, this should mean I can add the above facilities without any problems. Can anyone tell me if this sounds right? I am going to give it a try anyway, but I wanted to see if anyone thought I was crazy, or if there was a better way to do this. ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_)

1 0

Re:Error when starting syslog-ng (Kai Wang)
by Kai Wang 31 Jul '01

31 Jul '01

I found out the reason of the problem. After cloning, the default gateway configuration was lost. The line "destination d_test { udp("test.ucalgary.ca"); };" made syslog-ng unable to start. After I removed the line and relevant lines, syslog-ng started a short time and died quickly. After I added the default gateway, everything is working well. Kai

1 0

Configuring Chrooted apps to use /dev/log with syslog-ng
by Brian E. Seppanen 31 Jul '01

31 Jul '01

I'm trying to chroot bind, and I got to the part where it discusses setting up syslog so it will accept logs from chrooted apps. Is there any way of configuring syslog-ng to do something similar? Thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

2 1

RE: [syslog-ng]Error when starting syslog-ng
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 31 Jul '01

31 Jul '01

Probably going to need you to run an strace/truss on the application. This could mean a number of things. Something already has the port, etc. -----Original Message----- From: Kai Wang [mailto:kwang@ucalgary.ca] Sent: Monday, July 30, 2001 11:59 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Error when starting syslog-ng I have been running syslog-ng on aix 4.3.3 maintenance level 6 for monthes. I cloned our log server and found syslog-ng could not start on the new machine. I haven't changed a thing. # syslog-ng -v binding fd 3, unixaddr: /dev/log binding fd 4, inetaddr: 0.0.0.0, port: 514 Error creating AF_INET socket (Error 0) Error initializing configuration, exiting. Kai _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Error when starting syslog-ng
by Kai Wang 30 Jul '01

30 Jul '01

I have been running syslog-ng on aix 4.3.3 maintenance level 6 for monthes. I cloned our log server and found syslog-ng could not start on the new machine. I haven't changed a thing. # syslog-ng -v binding fd 3, unixaddr: /dev/log binding fd 4, inetaddr: 0.0.0.0, port: 514 Error creating AF_INET socket (Error 0) Error initializing configuration, exiting. Kai

1 0

syslog-ng forwarding logs over TCP.
by Ramji Chandramouli 27 Jul '01

27 Jul '01

Hi, I'm new to using syslog-ng as well as this mailing list. I'm particularly interested in the syslog-ng feature of forwarding logs over TCP. I think the version of syslog-ng I'm using is 1.4.10. The following is a scenario in which I'm having a log-forwarding problem. I have set up syslog-ng to forward logs over TCP to a server syslog-ng on a remote machine. Sometime during the log-forwarding, if the server syslog-ng dies for some unexpected reason, I find that the client syslog-ng does not recognize right away that the connection has been dropped. In fact, if there is a message, message #1, to be forwarded after the server syslog-ng has died, the client syslog-ng forwards message #1 and does not recognize that the connection is not alive. It is only when a second message, message #2, is to be forwarded that the client syslog-ng recognizes the error and I see a "io.c: do_write: write() failed". The problem is that when the server syslog-ng is brought back up, only message #2 is sent to the server syslog-ng. message #1 never gets to the server syslog-ng. Has this problem been already addressed in the subsequent versions ? Thanks.

1 0

TCP Wrapping Syslog
by Brian E. Seppanen 26 Jul '01

26 Jul '01

Hi: Does syslog-ng support tcp wrappers such that I could use hosts.allow to specify the hosts allowed to write syslog messages to a specific hosts? Does anyone no if legally syslog messages are null and void if an outside hosts write to a syslog server? If syslog-ng does support tcp wrappers what is the specific syntax would I refer to it as syslog: syslog-ng: or syslogd: thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

2 1

syslog-ng's memory footprint growing constantly
by Craig J Constantine 26 Jul '01

26 Jul '01

Hi, Basically, the memory size of the process simply grows and grows: USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 13899 0.1 19.3 25412 24764 ? S Jul24 2:05 syslog-ng That was snapped after about 4 hours of run time. If I let it run for days... well, it once got to 90000 VSZ before the box choked for lack of RAM. For gauging how heavily worked syslog-ng is, the line counts for all the files it writes (this is one day of logs) are: 0 UNCAUGHT.messages 180 facility.auth 68 facility.authpriv 1 facility.cron 15651 facility.daemon 1 facility.ftp 0 facility.kern 196 facility.local0 48 facility.local1 1 facility.local2 1 facility.local3 1532 facility.local4 1 facility.local5 1 facility.local6 31 facility.local7 1 facility.lpr 793 facility.mail 1 facility.news 16 facility.syslog 2 facility.user 1 facility.uucp 8818 service.mail 20395 service.popd 4083 service.radiusd 51822 total and total only about 6Mb in size. Is there something with internal buffers or garbage collection that I'm oblivious to? LARTs or terse FAQ pointers welcome... :) syslog-ng 1.4.11 on Linux (RedHat 6) on Intel with 128M mostly unused. Configuration is (sorry it's so long): ----------start config----------- options { chain_hostnames(no); use_fqdn(yes); create_dirs(yes); dir_perm(0755); sync(0); owner(root); group(web); perm(0644); }; source s_l { unix-stream("/dev/log"); internal(); }; source s_r { udp(ip( REAL_IP_HERE ) port(514)); }; destination local_kern { file("/var/log/syslog-ng/current/localhost.kern"); }; destination svc_radiusd { file("/var/log/syslog-ng/current/service.radiusd"); }; destination svc_popd { file("/var/log/syslog-ng/current/service.popd"); }; destination svc_mail { file("/var/log/syslog-ng/current/service.mail"); }; destination fac_auth { file("/var/log/syslog-ng/current/facility.auth"); }; destination fac_authpriv { file("/var/log/syslog-ng/current/facility.authpriv"); }; destination fac_cron { file("/var/log/syslog-ng/current/facility.cron"); }; destination fac_daemon { file("/var/log/syslog-ng/current/facility.daemon"); }; destination fac_ftp { file("/var/log/syslog-ng/current/facility.ftp"); }; destination fac_kern { file("/var/log/syslog-ng/current/facility.kern"); }; destination fac_lpr { file("/var/log/syslog-ng/current/facility.lpr"); }; destination fac_mail { file("/var/log/syslog-ng/current/facility.mail"); }; destination fac_news { file("/var/log/syslog-ng/current/facility.news"); }; destination fac_syslog { file("/var/log/syslog-ng/current/facility.syslog"); }; destination fac_user { file("/var/log/syslog-ng/current/facility.user"); }; destination fac_uucp { file("/var/log/syslog-ng/current/facility.uucp"); }; destination fac_local0 { file("/var/log/syslog-ng/current/facility.local0"); }; destination fac_local1 { file("/var/log/syslog-ng/current/facility.local1"); }; destination fac_local2 { file("/var/log/syslog-ng/current/facility.local2"); }; destination fac_local3 { file("/var/log/syslog-ng/current/facility.local3"); }; destination fac_local4 { file("/var/log/syslog-ng/current/facility.local4"); }; destination fac_local5 { file("/var/log/syslog-ng/current/facility.local5"); }; destination fac_local6 { file("/var/log/syslog-ng/current/facility.local6"); }; destination fac_local7 { file("/var/log/syslog-ng/current/facility.local7"); }; destination uncaught { file("/var/log/syslog-ng/current/UNCAUGHT.messages"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_syslog { facility(syslog); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_pri-gte-notice { priority(notice) or priority(emerg) or priority(alert) or priority(crit) or priority(err) or priority(warning); }; filter f_pri-gte-warning { priority(emerg) or priority(alert) or priority(crit) or priority(err) or priority(warning); }; filter f_pri-gte-err { priority(emerg) or priority(alert) or priority(crit) or priority(err); }; filter f_radiusd { program("radiusd"); }; filter f_popd { program("popd"); }; # A file for kern facility messages from this host only. log { source(s_l); filter(f_kern); destination(local_kern); }; # Log paths organizing all entries by facility. log { source(s_l); source(s_r); filter(f_auth); destination(fac_auth); }; log { source(s_l); source(s_r); filter(f_authpriv); destination(fac_authpriv); }; log { source(s_l); source(s_r); filter(f_cron); destination(fac_cron); }; log { source(s_l); source(s_r); filter(f_daemon); destination(fac_daemon); }; log { source(s_l); source(s_r); filter(f_ftp); destination(fac_ftp); }; log { source(s_l); source(s_r); filter(f_kern); destination(fac_kern); }; log { source(s_l); source(s_r); filter(f_lpr); destination(fac_lpr); }; log { source(s_l); source(s_r); filter(f_mail); filter(f_pri-gte-notice); destination(fac_mail); }; log { source(s_l); source(s_r); filter(f_mail); destination(svc_mail); }; log { source(s_l); source(s_r); filter(f_news); destination(fac_news); }; log { source(s_l); source(s_r); filter(f_syslog); destination(fac_syslog); }; log { source(s_l); source(s_r); filter(f_user); destination(fac_user); }; log { source(s_l); source(s_r); filter(f_uucp); destination(fac_uucp); }; # LOCAL0 facility is primarily used for POPD information. log { source(s_l); source(s_r); filter(f_local0); filter(f_pri-gte-notice); destination(fac_local0); }; log { source(s_l); source(s_r); filter(f_local0); filter(f_popd); destination(svc_popd); }; log { source(s_l); source(s_r); filter(f_local1); destination(fac_local1); }; log { source(s_l); source(s_r); filter(f_local2); destination(fac_local2); }; log { source(s_l); source(s_r); filter(f_local3); destination(fac_local3); }; log { source(s_l); source(s_r); filter(f_local4); destination(fac_local4); }; # LOCAL5 facility is primarily used for RADIUS information. log { source(s_l); source(s_r); filter(f_local5); filter(f_pri-gte-notice); destination(fac_local5); }; log { source(s_l); source(s_r); filter(f_local5); filter(f_radiusd); destination(svc_radiusd); }; log { source(s_l); source(s_r); filter(f_local6); destination(fac_local6); }; log { source(s_l); source(s_r); filter(f_local7); destination(fac_local7); }; # Catchall. If anything appears in here, we have something misconfigured. log { source(s_l); source(s_r); filter(DEFAULT); destination(uncaught); }; ----------stop config------------ -Craig

2 1

RE: [syslog-ng]Eliminating certain keyword from the "all" directi ve?
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 25 Jul '01

25 Jul '01

Stephen, Oh, then set up a filter: filter f_all_others { not facility(mail); }; Is this what you are looking for? This will get everything except the mail facility. Then you set whatever destinations you like. Regards, Drew -----Original Message----- From: Stephen C Burns [mailto:sburns@farpointer.net] Sent: Wednesday, July 25, 2001 7:24 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Eliminating certain keyword from the "all" directive? Thank you Drew, I already have something similar set up. I was not descriptive enough in my question. I have the default filter set. I have each one of my services logging to their own .log file. All messages to these individual .log files also go to the "all" destination which is a different file than the file for the default filter. And all that is fine - however, I would like for the mail messages to go to their own separate .log file only - and have no entry in the "all" file. I don't want to set them to /dev/null because I do want them, I just don't want them in the "all" file. :-) (They are not currently being logged to the "default" file) Thank you! -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Hamilton, Andrew Mr RAYTHEON 5 SIG CMD Sent: Tuesday, July 24, 2001 11:55 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]Eliminating certain keyword from the "all" directive? Stephen, Sure there's a way. Syslog-ng is a full service application after all. You want to set up a destination and a filter: destination mail { file("/var/adm/maillogs"); }; filter f_mail { facility(mail); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(DEFAULT); destination(all); }; The DEFAULT is a macro that will basically log everything that hasn't already been logged. If you just didn't want your mail logs just set the file to /dev/null or something. There are probably other ways to do this but this seems the most straight forward to me. Regards, DRew -----Original Message----- From: Stephen C Burns [mailto:sburns@farpointer.net] Sent: Tuesday, July 24, 2001 9:42 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Eliminating certain keyword from the "all" directive? Hi all, I have a question regarding the redirection of certain log messages to files. I currently have the "all" directive sending every syslog message into /var/log/messages, via: destination all { file("/var/log/messages"); }; And that is great, except I don't want my mail messages getting sent into the messages file as well as this takes up a lot of space. So I basically need some way to say "send all messages except for mail messages into /var/log/messages" Is there such a way? Thank you for any help!! _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2

couple bugs in syslog-ng-1.5.8
by Jay Soffian 25 Jul '01

25 Jul '01

Couple bugs in syslog-ng-1.5.8, patch included. j. ---------------------------------------------------------------------- diff -r -u syslog-ng-1.5.8.orig/configure syslog-ng-1.5.8/configure --- syslog-ng-1.5.8.orig/configure Wed Jul 11 07:11:01 2001 +++ syslog-ng-1.5.8/configure Wed Jul 25 01:56:01 2001 @@ -837,7 +837,7 @@ fi -sysconfdir="${sysconfdir}/syslog-ng" +sysconfdir="${sysconfdir}/syslog-ng/" echo $ac_n "checking whether build environment is sane""... $ac_c" 1>&6 echo "configure:844: checking whether build environment is sane" >&5 diff -r -u syslog-ng-1.5.8.orig/src/affile.c syslog-ng-1.5.8/src/affile.c --- syslog-ng-1.5.8.orig/src/affile.c Wed Jul 11 07:10:16 2001 +++ syslog-ng-1.5.8/src/affile.c Wed Jul 25 01:56:48 2001 @@ -520,6 +520,7 @@ } case M_FULLDATE: case M_ISODATE: + case M_DATE: case M_WEEKDAY: case M_YEAR: case M_MONTH: ----------------------------------------------------------------------

2 1

RE: [syslog-ng]Eliminating certain keyword from the "all" directi ve?
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 25 Jul '01

25 Jul '01

Stephen, Sure there's a way. Syslog-ng is a full service application after all. You want to set up a destination and a filter: destination mail { file("/var/adm/maillogs"); }; filter f_mail { facility(mail); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(DEFAULT); destination(all); }; The DEFAULT is a macro that will basically log everything that hasn't already been logged. If you just didn't want your mail logs just set the file to /dev/null or something. There are probably other ways to do this but this seems the most straight forward to me. Regards, DRew -----Original Message----- From: Stephen C Burns [mailto:sburns@farpointer.net] Sent: Tuesday, July 24, 2001 9:42 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Eliminating certain keyword from the "all" directive? Hi all, I have a question regarding the redirection of certain log messages to files. I currently have the "all" directive sending every syslog message into /var/log/messages, via: destination all { file("/var/log/messages"); }; And that is great, except I don't want my mail messages getting sent into the messages file as well as this takes up a lot of space. So I basically need some way to say "send all messages except for mail messages into /var/log/messages" Is there such a way? Thank you for any help!! _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Eliminating certain keyword from the "all" directive?
by Stephen C Burns 24 Jul '01

24 Jul '01

Hi all, I have a question regarding the redirection of certain log messages to files. I currently have the "all" directive sending every syslog message into /var/log/messages, via: destination all { file("/var/log/messages"); }; And that is great, except I don't want my mail messages getting sent into the messages file as well as this takes up a lot of space. So I basically need some way to say "send all messages except for mail messages into /var/log/messages" Is there such a way? Thank you for any help!!

1 0

conflict with redhat init scripts
by Michael Stenner 24 Jul '01

24 Jul '01

I'm using syslog-ng 1.4.11 on a redhat 7.1 machine and have discovered a conflict involving the way syslog-ng forks and exits, and the way redhat starts its daemons. I don't think either end is really doing anything wrong here, but I think some things could be tidied up a bit. Basically, I think it comes from the fact that when syslog-ng forks, the parent waits for the child to send it a SIGTERM, and then dies with exit code 0. Unfortunately, I think that initlog (the redhat tool for starting daemons and logging the results) is thinking that the daemon was sent an uncaught SIGTERM and is dying. Let me give you some examples of what I mean. When you use bash to start syslog-ng and then print the "exit status", $?, bash reports 143. From the bash manpage: When a command terminates on a fatal signal N, bash uses the value of 128+N as the exit status. 143 - 128 = 15 = SIGTERM When you use initlog to start syslog-ng, initlog returns 15 directly. It also logs (via syslog-ng, humorously) that syslog-ng failed to start. Consequently, the init script reports failure. I'm still confused about a couple of things. 1) I've trolled through the syslog-ng source, and It's clear that the TERM signal _should_ be caught, so why are bash and initlog detecting this? 2) I've trolled through the initlog source, and I can't find where initlog tries to detect the type of signal a program received, or even that it cares. As far as I can tell, it just looks for the exit value of the program. As you can see, I'm already hip-deep in both programs, so I'm certainly willing to try and help "fix" this. I'm just wondering about these last two points, and which end it would be best to fix it on. (the fact that bash reports as it does leads me to lean toward changing this behavior in syslog-ng) Thanks, Michael P.S. If anyone is interesting in doing the same source-diving that I've been doing, you can get the same things I've been using from: http://mirror.dulug.duke.edu/ mirror/dulug/dulug-7.1/SRPMS/dulug/syslog-ng-1.4.11-3.src.rpm http://mirror.dulug.duke.edu/ mirror/redhat/redhat-7.1/en/os/i386/SRPMS/initscripts-5.83-1.src.rpm source rpms can be unpacked to an arbitrary tmpdir with the following commands: SRCDIR=$HOME/tmp mkdir -p $SRCDIR/usr/src/redhat rpm --root $SRCDIR --install syslog-ng-1.4.11-3.src.rpm cd $SRCDIR/usr/src/redhat/SOURCES/ The rest should be obvious. -- Michael Stenner Office Phone: 919-660-2513 Duke University, Dept. of Physics mstenner(a)phy.duke.edu Box 90305, Durham N.C. 27708-0305

4 7

Problem with libol-0.2.23 syslog-ng 1.4.12
by James Eborall 20 Jul '01

20 Jul '01

Thanks for the patch to afstreams.c Now it works but I cannot use the 'door' source (this is Solaris 2.7). If I add source s_door { door ("/etc/.syslog_door"); }; to my syslog-ng.conf then I get a parse error, but door support is compiled in so is there something else I should check?. Thanks james

1 0

filter match usage
by Ravi Malghan 20 Jul '01

20 Jul '01

Hello: I want to use filter messages which begin with a string (for example RDP). Can I use match("^RDP") . Thanks Ravi

1 0

Problem compiling libol-0.2.23 and syslog-ng-1.4.12
by James Eborall 20 Jul '01

20 Jul '01

I have a problem compiling syslog-ng on Sol 2.7. libol compiles and installs ok. syslog-ng won't compile, afstreams.c: In function `io_stream_get'; afstreams.c:167: too few arguments to function `init_file' I've checked and the proto in libol/src/io.h has 4 arguments whereas the usage in afstreams.c is with 3, anyone have a fix? james

1 0

RE: [syslog-ng]Problem with libol-0.2.23 syslog-ng 1.4.12
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 20 Jul '01

20 Jul '01

look in the doc directory for the correct syntax. There is an example. Your syntax here is incorrect. Regards, Drew -----Original Message----- From: James Eborall [mailto:james.eborall@mci.co.uk] Sent: Friday, July 20, 2001 8:47 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Problem with libol-0.2.23 syslog-ng 1.4.12 Thanks for the patch to afstreams.c Now it works but I cannot use the 'door' source (this is Solaris 2.7). If I add source s_door { door ("/etc/.syslog_door"); }; to my syslog-ng.conf then I get a parse error, but door support is compiled in so is there something else I should check?. Thanks james

1 0

RE: [syslog-ng]Problem compiling libol-0.2.23 and syslog-ng-1.4.1 2
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 20 Jul '01

20 Jul '01

--- Balazs Scheidler <bazsi(a)balabit.hu> wrote: > try this patch: > > diff -u -r1.10.2.1 afstreams.c > --- afstreams.c 2001/02/25 12:30:22 1.10.2.1 > +++ afstreams.c 2001/07/16 08:26:55 > @@ -164,7 +164,7 @@ > { > NEW(stream_fd, f); > > - init_file(backend, &f->super, fd); > + init_file(backend, &f->super, fd, NULL); > f->super.prepare = prepare_stream_fd; > f->super.read = stream_read_callback; > f->super.want_read = 1; -----Original Message----- From: James Eborall [mailto:james.eborall@mci.co.uk] Sent: Friday, July 20, 2001 5:08 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Problem compiling libol-0.2.23 and syslog-ng-1.4.12 I have a problem compiling syslog-ng on Sol 2.7. libol compiles and installs ok. syslog-ng won't compile, afstreams.c: In function `io_stream_get'; afstreams.c:167: too few arguments to function `init_file' I've checked and the proto in libol/src/io.h has 4 arguments whereas the usage in afstreams.c is with 3, anyone have a fix? james

1 0

using perl module with syslog-ng
by Ravi Malghan 19 Jul '01

19 Jul '01

Hello: I have configured syslog-ng on solaris 2.7 and can see syslog messages logged into the /var/adm directory when I use the logger command. The perl module which I use in syslogd does not seem to working with syslog-ng the source line in syslog-ng server machine is source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; my perl lines are as follows openlog ($ident, 'ndelay', 'user'); syslog ("user.alert", "PingStatus change: Host %s is down\n", $host); Is there anything else I need to do to make this happen? Thanks Ravi

3 3

$HOST trouble.
by Alex Goldberg 18 Jul '01

18 Jul '01

Hi. I did a simple setup of syslog-ng 1.4.10 to log all remote messages based on hostname/facility.priority.: source s_udp { udp(); }; destination d_all { file("/var/logng/$HOST/$FACILITY.$PRIORITY"); }; log { source(s_sys) ; source(s_udp) ; destination(d_all); }; The problem is that when some progs log in non-stnadart format , I get a directory structure that looks like: >ls Thanks ?<Quantum ?<Sony ?Cmd ?Disconnected ?Generic ?Rev. ?SCSI ?pkt_flags=0x0 ?pkt_scbp=0x0 > CU Copyright Covered In Other San _ > and inside there will be a file with correct facility.priority name containing the remaining part of a message. Is there any way to use IP address of a source with DNS lookups , and not what source computers sends in a log message?

1 0

problem with make_class
by Matt Okeson-Harlow 18 Jul '01

18 Jul '01

this is the error i am getting when i try to build syslog-ng 1.4.12 make_class <afstreams.c >afstreams.c.xT /bin/sh: make_class: not found make[3]: *** [afstreams.c.x] Error 1 make[3]: Leaving directory `/export/home/mharlow/syslog-ng-1.4.12/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/export/home/mharlow/syslog-ng-1.4.12/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/export/home/mharlow/syslog-ng-1.4.12/src' make: *** [all-recursive] Error 1 any ideas? does make_class require another package installed? thanks! -- matt okeson-harlow matt at technomage.net http://www.technomage.net ($do || !$do) && undef($try) ; # Master of Perl, Yoda is. Hmmmm? http://shellforce.com <- shell accounts - web hosting -> http://cyberius.net send icbm here =--> 43°3'11'N-89°28'52"W

3 2

RE: [syslog-ng]Include files in Config
by Andrew Fort 18 Jul '01

18 Jul '01

Hi Brian, >Would it be possible to have a config file read in include >files that have >other definitions. I haven't seen anyone mention such a patch, but, you can use a makefile to build the single config file from multiple build files. You could use the Makefile to kill -HUP also, leaving updating your syslog-ng as simple as "cd blah && make" -afort

1 0

Include files in Config
by Brian E. Seppanen 17 Jul '01

17 Jul '01

Would it be possible to have a config file read in include files that have other definitions. For example, say I've got six different markets with cisco's all logging to different places is it possible to do include city1 include city2 include city3 This wouldn't serve much purpose other than cleaning up my config file I suppose, but that would help quite a bit. Has anyone implemented something similar? Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

1 0

RE: syslog-ng digest, Vol 1 #465 - 2 msgs
by Rolland, Yan 17 Jul '01

17 Jul '01

There is a problem with version 1.5.8. The config file that the daemon is checkin for is syslog-ngsyslog-ng.conf Seems like an accidental repeat. Should be syslog-ng.conf Yan Rolland The Parameter -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] Sent: Saturday, July 14, 2001 00:57 To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng digest, Vol 1 #465 - 2 msgs Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-admin(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: pulling data from a file (Brad Arlt) 2. Syslog 1.4.12, Solaris 8-x86: Too few arguments... (Sander) --__--__-- Message: 1 Date: Fri, 13 Jul 2001 14:02:57 -0600 From: Brad Arlt <arlt(a)cpsc.ucalgary.ca> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]pulling data from a file Reply-To: syslog-ng(a)lists.balabit.hu On Fri, Jul 13, 2001 at 12:32:39PM -0500, Matt Okeson-Harlow wrote: > this is all well and good, a fifo works just fine, > only problem is that cnr rolls the log files over itself... > any ideas on how to get a tail -f to reset and start reading the new file? tail won't. You would normally restart tail. You could just put the needed commands in your log rolling script. ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_) --__--__-- Message: 2 Date: Fri, 13 Jul 2001 23:25:10 +0200 From: Sander <sander(a)sanderscorner.com> To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Syslog 1.4.12, Solaris 8-x86: Too few arguments... Reply-To: syslog-ng(a)lists.balabit.hu I'm trying to compile syslog-ng 1.4.12 using gcc-2.95.3 and receive this error: gcc -DHAVE_CONFIG_H -I. -I/v/src/syslog-ng-1.4.12/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c: In function `io_stream_get': afstreams.c:167: too few arguments to function `init_file' *** Error code 1 make: Fatal error: Command failed for target `afstreams.o' Current working directory /v/src/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /v/src/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /v/src/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Anyone seen this before? Sander P.S.: Another minor point (just a warning), gcc also complains about this: gcc -DHAVE_CONFIG_H -I. -I/v/src/syslog-ng-1.4.12/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c log.c log.c: In function `parse_log_msg': log.c:58: warning: subscript has type `char' --__--__-- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng End of syslog-ng Digest

2 1

Syslog 1.4.12, Solaris 8-x86: Too few arguments...
by Sander 17 Jul '01

17 Jul '01

I'm trying to compile syslog-ng 1.4.12 using gcc-2.95.3 and receive this error: gcc -DHAVE_CONFIG_H -I. -I/v/src/syslog-ng-1.4.12/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c: In function `io_stream_get': afstreams.c:167: too few arguments to function `init_file' *** Error code 1 make: Fatal error: Command failed for target `afstreams.o' Current working directory /v/src/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /v/src/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /v/src/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Anyone seen this before? Sander P.S.: Another minor point (just a warning), gcc also complains about this: gcc -DHAVE_CONFIG_H -I. -I/v/src/syslog-ng-1.4.12/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c log.c log.c: In function `parse_log_msg': log.c:58: warning: subscript has type `char'

3 2