- syslog-ng - lists.balabit.hu

syslog binary error
by Ravi Malghan 16 Jul '01

16 Jul '01

Hello: I created a pkg (using pkgmk, pkgtrans) for syslog1.4.11 for solaris 7. I installed it on another solaris machine. It seems to be running normal, where syslog messages are passed from source to desitnation etc. But when I start the syslog-ng it outputs the string "Terminated". But the syslog is still running in the background. I donot get this error on the machine where I compiled the source code. Anybody noticed this? Thanks Ravi __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

1 0

RE: [syslog-ng]some basic questions syslog-ng
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 16 Jul '01

16 Jul '01

Ravi, Well, you are close but not quite there. When you set up a network source such as tcp or udp you are merely setting up a socket on which the server listens. It doesn't listen for a particular host. You set the server up to receive from a source and then you have your client log to that ip/port on the server. For example: source s_tcp { tcp(ip(192.168.1.1) port(2222)); }; This will cause syslog-ng to listen for log messages on the interface with 192.168.1.1 ip address and port number 2222. It doesn't matter where the messages is coming from. That is handled with the filters: filter f_host10 { host("192.168.10.1"); }; This will filter out the host with the ip address of 192.168.10.1. Then to log the remote host to the server you would use this line in your server: log { source(s_tcp); filter(f_host10); destination(d_host10); }; where d_host10 is a destination which the definition is not shown here. Hope this helps. Regards, Drew -----Original Message----- From: Ravi Malghan [mailto:rmalghan@yahoo.com] Sent: Friday, July 13, 2001 5:25 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]some basic questions syslog-ng So if I want to accept syslog messages on syslog-ng server X/port: 1111 from host 192.168.1.1, port: 2222 and host 192.168.10.1, port: 2222. I will have the following on server X source host10 {tcp(ip(192.168.1.1) port(2222); tcp(ip(192.168.10.1) port(2222); }; destination host10logs { file("/var/adm/host10.log" compress(on) sync(0); }; log {source(host10);destination(host10logs); }; Is this correct? I will similarly set the destination on the client machines to have destination {tcp(ip(server X) port (1111);} What does filter host10 {host("192.168.1.1"); }; give me ? Thanks Ravi --- "Hamilton, Andrew Mr RAYTHEON 5 SIG CMD" <HamiltonA(a)hq.5sigcmd.army.mil> wrote: > 1. The client syslog-ng makes a TCP connection to > the server which is > listening for a TCP request. > 2. Standard syslog is UDP and doesn't do TCP. You > have to have syslog-ng on > both the client and the server. > 3. The port is the same as the UDP port, 514. You > can have both types on > the same port. Yes you do have control over it. > You can change the source > port on the server and change the destination port > on the client. > > Regards, > Drew > -----Original Message----- > From: Ravi Malghan [mailto:rmalghan@yahoo.com] > Sent: Thursday, July 12, 2001 9:58 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]some basic questions syslog-ng > > > Hi I have few basic questions about syslog-ng. If > somebody can give me answers or give me some > pointers. > I am using syslog-ng to log syslog messages from a > client to server and a firewall between them. > 1. How is the sysloging TCP instead of UDP? Is this > something the syslog-ng needs to be configured. > 2. The client which initiates the syslog logging, is > this normal syslog client? or do I need to install > syslog-ng there too? > 3.When it uses TCP, which port does it use? Does the > user have control over the port number? > > Thanks in advance > Ravi > > > __________________________________________________ > Do You Yahoo!? > Get personalized email addresses from Yahoo! Mail > http://personal.mail.yahoo.com/ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 2

pulling data from a file
by Matt Okeson-Harlow 13 Jul '01

13 Jul '01

i have a question about syslog-ng and it's ability to pull from a non syslog file, i have a cisco network registrar dhcp server that is looking to /var/nwreg2/logs/name_dhcp_1_log (standard location) on Solaris 2.7 however when i have a source of source cnr { file("/var/nwreg2/logs/name_dhcp_1_log"); }; nothing gets logged, i did some reading it seems people have tried using logger to get to these kind of log files (tail -f | logger) however either i am missing something or it does not work here, anyone have any ideas? btw, syslog-ng when it starts up gives a EOF error which i am assuming is because it is expecting the file to never end. any ideas that anyone has would be appreciated -- matt okeson-harlow matt at technomage.net http://www.technomage.net ($do || !$do) && undef($try) ; # Master of Perl, Yoda is. Hmmmm? http://shellforce.com <- shell accounts - web hosting -> http://cyberius.net send icbm here =--> 43°3'11'N-89°28'52"W

4 4

anybody have syslog-ng binary?
by Ravi Malghan 13 Jul '01

13 Jul '01

Hi: Does anybody have syslog-ng binary to run on Solaris 2.7? If yes, could you please share it Thanks Ravi __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

1 0

RE: [syslog-ng]some basic questions syslog-ng
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 13 Jul '01

13 Jul '01

1. The client syslog-ng makes a TCP connection to the server which is listening for a TCP request. 2. Standard syslog is UDP and doesn't do TCP. You have to have syslog-ng on both the client and the server. 3. The port is the same as the UDP port, 514. You can have both types on the same port. Yes you do have control over it. You can change the source port on the server and change the destination port on the client. Regards, Drew -----Original Message----- From: Ravi Malghan [mailto:rmalghan@yahoo.com] Sent: Thursday, July 12, 2001 9:58 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]some basic questions syslog-ng Hi I have few basic questions about syslog-ng. If somebody can give me answers or give me some pointers. I am using syslog-ng to log syslog messages from a client to server and a firewall between them. 1. How is the sysloging TCP instead of UDP? Is this something the syslog-ng needs to be configured. 2. The client which initiates the syslog logging, is this normal syslog client? or do I need to install syslog-ng there too? 3.When it uses TCP, which port does it use? Does the user have control over the port number? Thanks in advance Ravi __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

filter(DEFAULT); not working?
by Volker Apelt 13 Jul '01

13 Jul '01

Hallo, I tried to use the filter(DEFAULT); expression but failed. Entries like <<datum>> www imapd[27520]: open: user va opened INBOX.misc.Tipps-und-Tricks <<datum>> www imapd[27520]: open: user va opened INBOX.OS.Netware.Tools <<datum>> www imapd[27520]: open: user va opened INBOX.Abfall <<datum>> www imapd[27555]: login: apelt-pc.in-house[192.168.51.2] va plaintext <<datum>> www imapd[27555]: seen_db: user va opened /var/imap/user/v/va.seen <<datum>> www imapd[27555]: open: user va opened user.va.Listen.SuSE.Security go to the default destination, too, although they have been written to some other destination already _and_ are explicitly excluded in the DEFAULT expression. Here is the log expression, which is responsible for the mysterious filter results. #all, not yet handled, should be low traffic log { source(src); filter(l_warn_or_worse); filter(F_not_mail); filter(F_not_news); filter(F_not_syslog); filter(f_not_kommunikation); filter(DEFAULT); destination(daemon); }; Is this a case of docu missinterpretation ? I have appended a shortend version of my syslog-ng.conf file a below. Thanks Volker Apelt -- Volker Apelt Group of Prof. Dr. Ch. Griesinger Dipl. Chem. Johann Wolfgang Goethe Universität +49 6172 31126 Frankfurt am Main, Germany va .@. org.chemie.uni-frankfurt.de (remove the dots, please) ###### part of syslog-ng.conf options { long_hostnames(off); sync(0); }; source src { unix-stream("/dev/log"); file("/proc/kmsg"); unix-stream("/cache/chroot/named/dev/log"); internal(); }; destination daemon { file("/var/log/daemon"); }; destination mailstore_info { file("/var/log/mail/mail_store.info"); }; destination mailstore_warn { file("/var/log/mail/mail_store.warn"); }; destination mailstore_err { file("/var/log/mail/mail_store.err"); }; filter F_news { facility(news); }; filter F_not_mail { not facility(mail); }; filter F_not_user { not facility(user); }; filter F_not_news { not facility(news); }; ### Levels # debug, info, notice, warning, err, crit, alert, emerg filter l_debug { level(debug); }; filter l_debug_or_worse { level(debug..emerg); }; filter l_info { level(info); }; filter l_info_or_worse { level(info..emerg); }; filter l_normal { level(info..notice); }; filter l_not_debug { level(info..emerg); }; filter l_notice { level(notice); }; filter l_notice_or_worse { level(notice..emerg); }; filter l_warn { level(warn); }; filter l_warn_or_worse { level(warn..emerg); }; filter l_err { level(err); }; filter l_err_or_worse { level(err..emerg); }; filter l_crit { level(crit); }; filter l_crit_or_worse { level(crit..emerg); }; filter l_alert { level(alert); }; filter l_alert_or_worse { level(alert..emerg); }; filter l_emergency { level(emerg); }; filter f_mailstore { not program("postfix.*") and ( program("imapd.*") or program("imap.*") or program("popper.*") or program("procmail.*") ) ; }; filter f_not_kommunikation { not program("imap.*") and not program("imapd.*") and not program("leafnode.*") and not program("mailfw.*") and not program("popper.*") and not program("postfix.*") and not program("procmail.*") and not program("qmgr.*") and not program("sendmail.*") and not program("test_filter.*") and not program("fetchnews") and not program("imapd.*") and not program("postfix.*") and not program("texpire"); }; # # a lot of other log {}; destinations .. # ## mail store server log { source(src); filter(F_mail);filter(f_mailstore); filter(l_debug_or_worse); destination(dev_null);}; log { source(src); filter(F_mail);filter(f_mailstore); filter(l_normal); destination(mailstore_info);}; log { source(src); filter(F_mail);filter(f_mailstore); filter(l_warn_or_worse); destination(mailstore_warn);}; log { source(src); filter(F_mail);filter(f_mailstore); filter(l_err_or_worse); destination(mailstore_err);}; #all, not yet handled, should be low traffic log { source(src); filter(l_warn_or_worse); filter(F_not_mail); filter(F_not_news); filter(F_not_syslog); filter(f_not_kommunikation); filter(DEFAULT); destination(daemon); };

1 0

config file problem in 1.5.8
by Balazs Scheidler 13 Jul '01

13 Jul '01

Hi, syslog-ng won't be able to open its config file because of a missing slash, the following patch fixes this problem: Index: syslog-ng.h =================================================================== RCS file: /var/cvs/syslog-ng/src/syslog-ng.h,v retrieving revision 1.19 diff -u -r1.19 syslog-ng.h --- syslog-ng.h 2001/07/08 17:04:21 1.19 +++ syslog-ng.h 2001/07/13 10:50:55 @@ -34,7 +34,7 @@ #define PATH_SYSLOG_NG_CONF "syslog-ng.conf" #define PATH_PIDFILE "syslog-ng.pid" #else -#define PATH_SYSLOG_NG_CONF PATH_SYSCONFDIR "syslog-ng.conf" +#define PATH_SYSLOG_NG_CONF PATH_SYSCONFDIR "/syslog-ng.conf" #define PATH_PIDFILE "/var/run/syslog-ng.pid" #endif -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

syslog-ng 1.4.12 and 1.5.8 release
by Balazs Scheidler 13 Jul '01

13 Jul '01

Hi, I released syslog-ng 1.4.12 and 1.5.8 yesterday. You can find it at the usual places. 1.5.8 users beware: - filter(DEFAULT) was removed, and some log processing flags were added instead: * catchall * final * fallback The usage is: log { source(src); destination(dst); fallback; }; I still don't like the syntax it is using, so this might change in the future. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]stupid regexp question
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 13 Jul '01

13 Jul '01

Michael, Your format is annoying and make take some tweaking of your filters to get around. Syslog-ng, as you know, does various types of matching, on the program, the host, the message, etc, there are different functions that do those things. For the message portion there is match(), for the program portion there is program(), and for host there is host(), you get the idea. I think you are matching a field other than the message when you are using the match function. It's hard to be sure since I'm not familiar with the NT logging format, but that is what I am guessing. Try using one of the other functions to match your expression. Another way you might get a handle on the structure as syslog-ng sees the messages is to use a destination that structures the messages using the DEFAULT filter and the macros, $HOST, $FACILITY, $PRIORITY, etc that will tell you the format of the message so you can filter out the way syslog-ng sees it. In version 1.5.X there is also the template() function that lets you format the output from syslog-ng however you want. Hope this helps. Regards, Drew -----Original Message----- From: Michael Hargadon [mailto:MHargadon@ITDepartment.com] Sent: Thursday, July 12, 2001 11:41 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]stupid regexp question Good afternoon. I use a linux box as a concentration point for the system logs of several NT servers I monitor. This is done through services running on the NT machine which provide standard syslog functionality -- they forward any messages written to the NT event log to a destination I specify. The format in which the messages are received is somewhat irritating, eg: Jul 12 17:36:25 1.2.3.4 Thu Jul 12 17:34:00 2001: SOMEHOST/Security (528) - "Successful Logon: User Name: xservice Domain: SOMEDOMAIN Logon ID: (0x0,0x34616CAB) Logon Type: 3 Logon Process: NtLmSsp Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: SOMESTATION" A large number of the messages we receive we'd prefer not to log to disk. I set up a destination pointing to /dev/null for this purpose. My intention is to use regular expressions to separate useful messages from the useless (and repetitive) ones. As an example of the above, I defined a filter as follows: filter f_nt0001 { match("Security (528)"); }; As well as a log rule as follows: log { source(src); filter(f_nt0002); destination(null); }; However, I'm having issues getting the match rule to work. I suspect it's the parantheses, since AFAIK they're supposed to be a regexp-reserved character. If, however, I escape them with \( messages received which fall into this category don't hit the filter. I know there's something fundamentally obvious that I'm overlooking here but I can't figure it out. Can anyone offer any assistance? Regards, Michael Hargadon mhargadon(a)itdepartment.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

stupid regexp question
by Michael Hargadon 12 Jul '01

12 Jul '01

Good afternoon. I use a linux box as a concentration point for the system logs of several NT servers I monitor. This is done through services running on the NT machine which provide standard syslog functionality -- they forward any messages written to the NT event log to a destination I specify. The format in which the messages are received is somewhat irritating, eg: Jul 12 17:36:25 1.2.3.4 Thu Jul 12 17:34:00 2001: SOMEHOST/Security (528) - "Successful Logon: User Name: xservice Domain: SOMEDOMAIN Logon ID: (0x0,0x34616CAB) Logon Type: 3 Logon Process: NtLmSsp Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: SOMESTATION" A large number of the messages we receive we'd prefer not to log to disk. I set up a destination pointing to /dev/null for this purpose. My intention is to use regular expressions to separate useful messages from the useless (and repetitive) ones. As an example of the above, I defined a filter as follows: filter f_nt0001 { match("Security (528)"); }; As well as a log rule as follows: log { source(src); filter(f_nt0002); destination(null); }; However, I'm having issues getting the match rule to work. I suspect it's the parantheses, since AFAIK they're supposed to be a regexp-reserved character. If, however, I escape them with \( messages received which fall into this category don't hit the filter. I know there's something fundamentally obvious that I'm overlooking here but I can't figure it out. Can anyone offer any assistance? Regards, Michael Hargadon mhargadon(a)itdepartment.com

1 0

some basic questions syslog-ng
by Ravi Malghan 12 Jul '01

12 Jul '01

Hi I have few basic questions about syslog-ng. If somebody can give me answers or give me some pointers. I am using syslog-ng to log syslog messages from a client to server and a firewall between them. 1. How is the sysloging TCP instead of UDP? Is this something the syslog-ng needs to be configured. 2. The client which initiates the syslog logging, is this normal syslog client? or do I need to install syslog-ng there too? 3.When it uses TCP, which port does it use? Does the user have control over the port number? Thanks in advance Ravi __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

1 0

unscribe
by Simon Yang 11 Jul '01

11 Jul '01

unscribe

1 0

RE: [syslog-ng]syslog-ng.conf
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 11 Jul '01

11 Jul '01

And there is always a macro filter $HOST that you could separate all the hosts into their own files. destination d_host_logs { file("/var/adm/hosts/$HOST.log"); }; That would save you the performance hit unless there were a great deal of hosts and you may run out of open file descriptor slots. Of course this may not be really what you want as this would put everything in a separate file by host. Depends on what you need to do. Regards, Drew -----Original Message----- From: Nijs, Daniel [mailto:NijsD@telergy.net] Sent: Wednesday, July 11, 2001 3:13 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]syslog-ng.conf This is what I had in mind, but I am not sure what the performance overhead will be when I have many rules of this type where I want the data in a seperate file. For now it will do the job, but hopefully this (a directive to stop processing the rules any further) could be an option added to the filter statement in a future release. Thanks for the help. Best regards, Dan -----Original Message----- From: Hamilton, Andrew Mr RAYTHEON 5 SIG CMD [mailto:HamiltonA@hq.5sigcmd.army.mil] Sent: Wednesday, July 11, 2001 6:13 AM To: 'syslog-ng(a)lists.balabit.hu' Cc: Nijs, Daniel Subject: RE: [syslog-ng]syslog-ng.conf Dan, It's true that syslog-ng continues to log after a match was found and this is a necessary function of the software. It logs as long as a match is found. Your best bet on filtering out the things you don't want in the log by using the boolean operators in you filters: filter f_host_ip { facility(daemon) and not host("10.10.10.10"); }; Something of this nature and then add your host in a filter: filter f_myhost { facility(daemon) and host("10.10.10.10"); }; Like that. Hope that helps. Regards, Drew -----Original Message----- From: Nijs, Daniel [mailto:NijsD@telergy.net] Sent: Tuesday, July 10, 2001 9:28 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng.conf Hello, I am relatively new to syslog-ng (only been running it for a month) and love the software. I would like to congratulate the author on doing such a great job. This is a powerful product, and with this comes complexity, and I have a few questions I am not able to find an answer for. I have a webserver logging to a centralized host, and I filter the logs using specific criteria (i.e. document name). Let's give this file a name to make this question easier to understand. I log this data to hits.log. Now, I want to filter out a certain IP to a separate file (ip.log), and not show the entries that were logged to ip.log in hits.log. It seems that syslog-ng keeps processing all rules, even after there was a match. I was hoping that there was an option to stop processing any further rules for that matched data to solve this problem, but am unable to find any solution. Does anyone have any suggestions on how to do this? Thanks. Best regards, Dan _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]syslog-ng.conf
by Nijs, Daniel 11 Jul '01

11 Jul '01

This is what I had in mind, but I am not sure what the performance overhead will be when I have many rules of this type where I want the data in a seperate file. For now it will do the job, but hopefully this (a directive to stop processing the rules any further) could be an option added to the filter statement in a future release. Thanks for the help. Best regards, Dan -----Original Message----- From: Hamilton, Andrew Mr RAYTHEON 5 SIG CMD [mailto:HamiltonA@hq.5sigcmd.army.mil] Sent: Wednesday, July 11, 2001 6:13 AM To: 'syslog-ng(a)lists.balabit.hu' Cc: Nijs, Daniel Subject: RE: [syslog-ng]syslog-ng.conf Dan, It's true that syslog-ng continues to log after a match was found and this is a necessary function of the software. It logs as long as a match is found. Your best bet on filtering out the things you don't want in the log by using the boolean operators in you filters: filter f_host_ip { facility(daemon) and not host("10.10.10.10"); }; Something of this nature and then add your host in a filter: filter f_myhost { facility(daemon) and host("10.10.10.10"); }; Like that. Hope that helps. Regards, Drew -----Original Message----- From: Nijs, Daniel [mailto:NijsD@telergy.net] Sent: Tuesday, July 10, 2001 9:28 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng.conf Hello, I am relatively new to syslog-ng (only been running it for a month) and love the software. I would like to congratulate the author on doing such a great job. This is a powerful product, and with this comes complexity, and I have a few questions I am not able to find an answer for. I have a webserver logging to a centralized host, and I filter the logs using specific criteria (i.e. document name). Let's give this file a name to make this question easier to understand. I log this data to hits.log. Now, I want to filter out a certain IP to a separate file (ip.log), and not show the entries that were logged to ip.log in hits.log. It seems that syslog-ng keeps processing all rules, even after there was a match. I was hoping that there was an option to stop processing any further rules for that matched data to solve this problem, but am unable to find any solution. Does anyone have any suggestions on how to do this? Thanks. Best regards, Dan _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]syslog-ng.conf
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 11 Jul '01

11 Jul '01

Dan, It's true that syslog-ng continues to log after a match was found and this is a necessary function of the software. It logs as long as a match is found. Your best bet on filtering out the things you don't want in the log by using the boolean operators in you filters: filter f_host_ip { facility(daemon) and not host("10.10.10.10"); }; Something of this nature and then add your host in a filter: filter f_myhost { facility(daemon) and host("10.10.10.10"); }; Like that. Hope that helps. Regards, Drew -----Original Message----- From: Nijs, Daniel [mailto:NijsD@telergy.net] Sent: Tuesday, July 10, 2001 9:28 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng.conf Hello, I am relatively new to syslog-ng (only been running it for a month) and love the software. I would like to congratulate the author on doing such a great job. This is a powerful product, and with this comes complexity, and I have a few questions I am not able to find an answer for. I have a webserver logging to a centralized host, and I filter the logs using specific criteria (i.e. document name). Let's give this file a name to make this question easier to understand. I log this data to hits.log. Now, I want to filter out a certain IP to a separate file (ip.log), and not show the entries that were logged to ip.log in hits.log. It seems that syslog-ng keeps processing all rules, even after there was a match. I was hoping that there was an option to stop processing any further rules for that matched data to solve this problem, but am unable to find any solution. Does anyone have any suggestions on how to do this? Thanks. Best regards, Dan _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

syslogging snmptraps
by Brian E. Seppanen 10 Jul '01

10 Jul '01

Hello: I'm using syslog-ng-1.4.11 on a solaris 2.6 host. The box is likewise configured as an snmptrap host, which are then logged. Is there a field length limit for the messages that will be logged with syslog-ng or syslog in general. Some traps seem to run out of space and stop prematurely. An example below Jul 10 14:53:09 host snmptrapd[8971]: host: Enterprise Specific Trap (ciscoNetRegFreeAddressLow) Uptime: 21 days, 10:02:46.00, system.sysDescr = Cisco Systems, Inc. blah blah blah blah blah blah, enterprises.cisco.ciscoMgmt.ciscoNetworkRegistrarMIB.ciscoNetworkRegistrarMIBObjects.cnrDHCP.cnrDHCPScopeTable.cnrDHCPScopeEntry.cnrDHCPScopeFreeAddrLowThreshold.78.87.45.84.86.67.45.85.66.82.49.45.73.80.66.85.78.68.76.69.53.45.80.67 = Wrong Type (should be Gauge32 or Unsigned32): 20, enterprises.cisco.ciscoMgmt.ciscoNetworkRegistrarMIB.ciscoNetworkRegistrarMIBObjects.cnrDHCP.cnrDHCPScopeTable.cnrDHCPScopeEntry.cnrDHCPScopeFreeAddrValue.78.87.45.84.86.67.45.85.66.82.49.45.73.80.66.85.78.68.76.69.53.45.80.67 = Wrong Type (should be Gauge32 or Unsigned32): 20, enterprises.cisco.ciscoMgmt.ciscoNetworkRegistrarMIB.ciscoNetworkRegistrarMIBObjects.cnrDHCP.cnrDHCPScopeTable.cnrDHCPScopeEntry.cnrDHCPScopeFreeAddrUnits.78.87.45.84.86.67.45.85.66.82.49.45.73.80.66.85.78.68.76.69.53.45.80.67 = percen Any insights appreciated. Thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

1 0

syslog-ng.conf
by Nijs, Daniel 10 Jul '01

10 Jul '01

Hello, I am relatively new to syslog-ng (only been running it for a month) and love the software. I would like to congratulate the author on doing such a great job. This is a powerful product, and with this comes complexity, and I have a few questions I am not able to find an answer for. I have a webserver logging to a centralized host, and I filter the logs using specific criteria (i.e. document name). Let's give this file a name to make this question easier to understand. I log this data to hits.log. Now, I want to filter out a certain IP to a separate file (ip.log), and not show the entries that were logged to ip.log in hits.log. It seems that syslog-ng keeps processing all rules, even after there was a match. I was hoping that there was an option to stop processing any further rules for that matched data to solve this problem, but am unable to find any solution. Does anyone have any suggestions on how to do this? Thanks. Best regards, Dan

1 0

From Linux to Solaris
by Brian E. Seppanen 09 Jul '01

09 Jul '01

Hello: I'm in the process of moving logging from a linux box to a solaris 2.6 box. Can someone who's done similar point out any caveats of doing so? Will I only need to enable a new source for door? Are kernel messages still handled by /proc/kmesg? Any help appreciated...Thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

2 1

Log Stopage
by Gorm Jensen 08 Jul '01

08 Jul '01

After upgrading from RH6.1 and syslog-ng-1.4.2 to RH7.1 and syslog-ng-1.4.11, only the first hit of a series of hits on the firewall is logged. Restarting the daemon will cause the next hit to be logged, but no more than that. Only the logging of firewall hits is effected. After a great deal of trial and error, I traced the problem to a specific destination in the configuration file. I have attached two verions (Linux text and MS.txt) of the config file. To simplify the configuraton for testing, I deleted several other log destinations, filters and actions. The anomaly persisted, even with the simplified configuration. When the lines containing the destination 'whodat' are commented out, logging proceeds as expected. When the comments are aranged to include either one of the lines containing the whodat destination, the logging reverts to what is described in para one. Can anyone tell what is required to fix the problem?

2 1

Duplicate Entries
by Vinay Bharel 08 Jul '01

08 Jul '01

I just started running syslog-ng on a Linux box. I have also configured one of my Solaris 8 servers to send logs to this machine. I have noticed that I get duplicate log entries sometimes. I can't figure out why. For example: Jul 3 20:32:44 dns-a vinay: [ID 702911 daemon.warning] test Jul 3 20:32:44 dns-a vinay: [ID 702911 daemon.warning] test Jul 3 20:32:44 dns-a vinay: [ID 702911 daemon.warning] test Jul 3 20:32:44 dns-a vinay: [ID 702911 daemon.warning] test The Solaris 8 box has the following entry in it's syslog.conf: *.debug @loghost This is my syslog-ng.conf: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); }; source external { udp(ip (0.0.0.0) port(514)); }; filter f_filter1 { level(info) and facility(user) or facility(kern) or facility(mail) or facility(daemon) or facility(daemon) or facility(auth) or facility(lpr) or facility(news) or facility(uucp) or facility(cron) or facility(syslog) or facility(ftp) or facility(authpriv) or facility(cron); }; filter f_dns-a { host(dns-a); }; destination d_dns-a { file("/var/log/machine/$YEAR/$MONTH/$HOST.$DAY");}; log { source(external); filter(f_dns-a); destination (d_dns-a); }; - Vinay Bharel <vinay(a)bharel.com>

2 1

Syslog.conf translator
by Keith Morse 05 Jul '01

05 Jul '01

This is a follow on to Jonathan Marks awk script published 1 May 2001. I've just started down the path to enlightenment (or getting up to speed on syslog-ng) with respect to implementing on solaris. A couple of notes in relation to your awk script. 1. I believe the error you are getting is due to the fact you were probably using the original awk variant. "close()" is only applicable for nawk and gawk. Which make sense as Balazs Scheidler had luck with this on Linux, which if I remember correctly awk is a link to gawk. 2. Conversely I couldn't get the script to work with the file as an arguement but only if I fed it to the script. Go figure? Thanks for taking the time to write this script. I think it will help in providing me a starting place to figure this critter out. >On 4 May 2001, Jon Marks j-marks(a)uiuc.edu spake thusly: > >Hi, > >I've tried out the copy of the awk script syslog2ng incorporated into >the development branch contrib directory-- but it won't run. It's a >parse error that only seems to crop up when awk is fed this program on >its stdin, but not as a command line argument. I'm still not sure why >it doesn't work-- what about its parsing would change using -f? Any >seasoned awk programmers out there want to help out? I'm grateful for >any advice! It's always the same syntactic construct that causes the >error: >BEGIN { > # Handle the various platforms- determine proper log device > "/bin/uname -s" | getline sysname; # <-- ERROR HERE!! > close("/bin/uname -s");

1 0

Logging to multiple destinations
by Brian E. Seppanen 29 Jun '01

29 Jun '01

Is it possible to log multiple destinations (files) at the same time, such that a box would log its messages locally as well as forward them on? Thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

2 1

Ownership per host
by Ohrberg, Mick 29 Jun '01

29 Jun '01

This might just be a case of RTFM on my behalf... Is there a way to set different group or ownership on logfiles depending on certain criteria (such as $PROGRAM, $HOST etc etc)? Regards, -- Mick Öhrberg Open Systems Administrator, UMB Bank na [NYSE:UMBF] Ph: (816)860-1064 Fax: (816)860-3934 PGP: http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0xD98D5C7B

2 1

Add Me
by samuele ghelfi 29 Jun '01

29 Jun '01

Please add me to the syslog mailing list Sam __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

1 0

Logging Kernel Messages
by Brian E. Seppanen 28 Jun '01

28 Jun '01

I'm trying to capture messages that are logged at a specific facility (kern) to a specific kernel.log file. Below are my definitions source kernel_file { file("/proc/kmsg"); }; destination kernel { file("/var/kernel/kernel.log");}; filter kern {facility(kern);}; log { source(kernel_file); filter(kern); destination(kernel);}; log { source(internal_src); filter(kern); destination(kernel);}; log { source(stream); filter(kern); destination(kernel);}; log { source(udp_src); filter(kern); destination(kernel);}; When I issue the following logger -p kern.info "test messages" The logs show up in my default message log. Am I missing something, this doesn't seem right...? I've configured it to take it from four different sources just to make sure it was being captured, as I think I only need the kernel_file source. This is on a redhat linux 7.0 pc. Thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

3 2