- syslog-ng - lists.balabit.hu

RE: [syslog-ng]odd problem
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 03 Apr '01

03 Apr '01

I'm not 100% certain but I don't think that will work. syslog-ng picks the first log statement and logs the message to that. After that it considers the message logged and will log nothing to the next log statement. What I am curious about is why the multiple destination thing didn't work. I use it often and it works for me just fine. I am using 1.4.7 in production but I have been testing the 1.5 series and will go to production with it soon. Both seem to do this just fine. What is the error you are getting from the multiple destination configuration? Regards, Drew > -----Original Message----- > From: Chad C. Walstrom [SMTP:chewie@wookimus.net] > Sent: Monday, April 02, 2001 11:19 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]odd problem > > On Mon, Apr 02, 2001 at 04:38:30PM -0400, jon(a)dumbo.pobox.com wrote: > > syslog-ng-1.4.11/ > > libol-0.2.21/ > > > > i guess i'll try upgrading.... > > > > how does one log to multiple destinations without putting everything > into the same > > destination XXX {} container? > > > > i've tried seperate destinations > > ie... > > destination x { tcp(208.210.124.50 port(514)); } > > destinayion y { > file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY" > dir_perm(0755) perm(0644)) } > > > > and then in the log directive > > log { > > source(src); > > destination(x); > > destination(y); > > } > > > > but that gives me errors > > Try: > log{ source(src); destination(x); }; > log{ source(src); destination(y); }; > > -- > Chad Walstrom <chewie(a)wookimus.net> | a.k.a. ^chewie > http://www.wookimus.net/ | s.k.a. gunnarr > Key fingerprint = B4AB D627 9CBD 687E 7A31 1950 0CC7 0B18 206C 5AFD >

2 1

Solaris 7 TCP Destination Error syslog-ng 1.4.11
by David C Niemi 02 Apr '01

02 Apr '01

I am trying to forward logs to another box from a Solaris 7 (SPARC) machine. The error I get is puzzling: sinetva99{SUPERUSER:25}/tmp# syslog-ng -d -f syslog-remote.conf io.c: Preparing fd 3 for reading io.c: connecting using fd 4 Error creating AF_INET socket (Operation now in progress) Error initializing configuration, exiting. Solaris' man page for connect defines EINPROGRESS quite cryptically: EINPROGRESS The socket is non-blocking and the connection can- not be completed immediately. It is possible to select(3C) for completion by selecting the socket for writing. However, this is only possible if the socket STREAMS module is the topmost module on the protocol stack with a write service procedure. This will be the normal case. So it sounds vaguely like the socket needs to be blocking, but I don't see any option in syslog-ng for accomplishing this. The relevant part of my .conf file: source src { file("/dev/log"); internal(); }; destination remote { tcp(208.214.21.133 port(514) ); }; log { source(src); destination(remote); }; I've managed to use virtually the same configuration to forward successfully under TCP using a Linux source. I also find that sending to localhost works fine under Solaris, but I get the error whenever I try a remote TCP destination from Solaris. "truss" does not return anything terribly interesting. --------------------------------------------------------- David C. Niemi (Reston, Virginia, USA) niemi(a)tuxers.net Know the difference between the color of the wine and the color of the glass. (Jalaluddin Rumi) ---------------------------------------------------------

2 2

AIX error
by Kathia Juca 02 Apr '01

02 Apr '01

Hi I'm running syslog-ng 1.4.11 on AIX . I intend log 80 machines to one hosts using syslog-ng. But, I use one server for compile. I need install in 80 machines . What syslog-ng and libol packages ??. Can'I transfer code after compile ?? I tried transfer and error message was : # /usr/local/sbin/syslog-ng Could not load program /usr/local/sbin/syslog-ng Symbol io_callout_set_drop in syslog-ng is undefined Symbol io_callout_flush in syslog-ng is undefined Error was: Exec format error What's right procedure for this ?? Thanks Kathia Juca Universidade Federal de Santa Catarina Florianopolis - Santa Catarina - Brazil

2 1

RE: [syslog-ng]Feature Request
by Andrew Fort 01 Apr '01

01 Apr '01

> Next thing to ask for is a feature request that would make our use of > syslog infintely more flexible: a string formatter module. Take this > hypothetical syslog-ng.conf entry as an example: the 1.5 development releases allow you to specify what fields to go the output for some destinations. i've attached a previous post of mine with the field list inside, and quoting Balazs' original feature announcement. you may be able to use this in conjunction with other facilities, a log watcher, the program destination, whatever, to achieve your goal. -afort

5 9

Syslog-ng and a log checker
by Dennis Kruyt 01 Apr '01

01 Apr '01

Hi, I'm logging from about 20 machines to a log server and i want to use a program that checks the log files. So wich program works good with syslog-ng??? Dennis,

2 1

Syslog-NG Performance
by Scott, Joshua 30 Mar '01

30 Mar '01

I plan on using 1 server with Syslog-ng to maintain all of the log files for my firewalls. I want to make sure I don't overload this server. This server is a PIII 800Mhz with 512MB ram. At this point the amount of data I'll be sending to syslog-ng will be approx 2GB daily. Can anyone tell me how what experiences they've had with this type of scenario? Is there a limit to the amount of devices syslog-ng can handle? > Joshua Scott > Security Systems Analyst > Jacobs Engineering Group > IS - Network Services > 1111 South Arroyo Parkway > Pasadena, California, 91105 > Office: (626) 568-7024 > Mobile: (866) 810-5234 > Fax: (626) 578-6967 >

2 1

RE: [syslog-ng]syslog-ng 1.5.5 compilation trouble
by Ohrberg, Mick 30 Mar '01

30 Mar '01

Bazsi, That did it! With one exception. I had to add #ifndef INADDR_NONE #define INADDR_NONE ((unsigned long) -1) #endif to nscache.c, but after that, it compiled like a champ! (Sorry, don't know how to make patches... :-/ ) Thanks!! > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: Friday, March 30, 2001 9:09 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]syslog-ng 1.5.5 compilation trouble > > > On Fri, Mar 30, 2001 at 08:13:59AM -0600, Ohrberg, Mick wrote: > > Hmm, Maybe I'm just messing up horribly on this wonderful > Friday morning. I > > can't compile syslog-ng 1.5.5! > > > > ... > > checking whether to enable Sun STREAMS support... yes > > checking whether to enable Sun door support... yes > > checking libol version >= 0.2.22... ./configure: !: not found > > ok > > updating cache ./config.cache > > ... > > > > Woah there! I DO have libol 0.2.22 installed! I found a > problem in my > > configure... Anyone else run into this problem? Instead of doing > > > > if ! test -x ... > > > > I changed it to > > > > if [ ! -x ... ]; do > > ops... bash eats the first construct, but it doesn't seem to > be portable. > > nscache.h seems to be missing from the dist. The patch below fixes the > problem above, and adds nscache.h: > > diff -urN syslog-ng-1.5.5/configure syslog-ng-1.5.5a/configure > --- syslog-ng-1.5.5/configure Fri Mar 30 14:12:39 2001 > +++ syslog-ng-1.5.5a/configure Fri Mar 30 17:03:02 2001 > @@ -700,7 +700,7 @@ > > PACKAGE=syslog-ng > > -VERSION="1.5.5" > +VERSION="1.5.5a" > > if test "`cd $srcdir && pwd`" != "`pwd`" && test -f > $srcdir/config.status; then > { echo "configure: error: source directory already > configured; run "make distclean" there first" 1>&2; exit 1; } > @@ -2670,7 +2670,7 @@ > echo "configure:2671: checking libol version >= > $LIBOL_REQ_MAJOR.$LIBOL_REQ_MINOR.$LIBOL_REQ_PATCH" >&5 > > if test "$with_libol" = ""; then > - if ! test -x `which libol-config` ; then > + if test ! -x `which libol-config` ; then > { echo "configure: error: libol-config not > found, either install libol or supply its location with > --with-libol" 1>&2; exit 1; } > fi > LIBOL_VERSION=`libol-config --version` > @@ -2678,7 +2678,7 @@ > LIBOL_LIBS=`libol-config --static-libs` > MAKE_CLASS="make_class" > else > - if ! test -x $with_libol/libol-config; then > + if test ! -x $with_libol/libol-config; then > { echo "configure: error: libol-config not > found in the specified location" 1>&2; exit 1; } > fi > LIBOL_VERSION=`$with_libol/libol-config --version` > diff -urN syslog-ng-1.5.5/configure.in syslog-ng-1.5.5a/configure.in > --- syslog-ng-1.5.5/configure.in Fri Mar 30 14:12:37 2001 > +++ syslog-ng-1.5.5a/configure.in Fri Mar 30 17:02:31 2001 > @@ -1,8 +1,8 @@ > -dnl $Id: configure.in,v 1.32 2001/02/25 12:01:38 bazsi Exp $ > +dnl $Id: configure.in,v 1.33 2001/03/30 15:02:31 bazsi Exp $ > dnl Process this file with autoconf to produce a configure script. > AC_INIT(src/affile.c) > > -AM_INIT_AUTOMAKE(syslog-ng, "1.5.5") > +AM_INIT_AUTOMAKE(syslog-ng, "1.5.5a") > LIBOL_REQ_MAJOR=0 > LIBOL_REQ_MINOR=2 > LIBOL_REQ_PATCH=22 > @@ -148,7 +148,7 @@ > AC_MSG_CHECKING(libol version >= > $LIBOL_REQ_MAJOR.$LIBOL_REQ_MINOR.$LIBOL_REQ_PATCH) > > if test "$with_libol" = ""; then > - if ! test -x `which libol-config` ; then > + if test ! -x `which libol-config` ; then > AC_ERROR([libol-config not found, either > install libol or supply its location with --with-libol]) > fi > LIBOL_VERSION=`libol-config --version` > @@ -156,7 +156,7 @@ > LIBOL_LIBS=`libol-config --static-libs` > MAKE_CLASS="make_class" > else > - if ! test -x $with_libol/libol-config; then > + if test ! -x $with_libol/libol-config; then > AC_ERROR(libol-config not found in the > specified location) > fi > LIBOL_VERSION=`$with_libol/libol-config --version` > diff -urN syslog-ng-1.5.5/doc/sgml/syslog-ng.sgml > syslog-ng-1.5.5a/doc/sgml/syslog-ng.sgml > --- syslog-ng-1.5.5/doc/sgml/syslog-ng.sgml Fri Mar 30 14:41:01 2001 > +++ syslog-ng-1.5.5a/doc/sgml/syslog-ng.sgml Fri Mar 30 15:08:27 2001 > @@ -1074,7 +1074,7 @@ > as commands to the SQL server. > </entry> > <entry> > - a format conforming to default logfile format. > + yes > </entry> > </row> > </tbody> > diff -urN syslog-ng-1.5.5/doc/sgml/syslog-ng.txt > syslog-ng-1.5.5a/doc/sgml/syslog-ng.txt > --- syslog-ng-1.5.5/doc/sgml/syslog-ng.txt Fri Mar 30 14:41:50 2001 > +++ syslog-ng-1.5.5a/doc/sgml/syslog-ng.txt Fri Mar 30 17:03:37 2001 > @@ -553,8 +553,7 @@ > template_escape() yes or no Turns on escaping ' and " in templated > output files. It is useful for generating SQL statements > and quoting > string contents so that parts of your log message don't get > - interpreted as commands to the SQL server. a format conforming to > - default logfile format. > + interpreted as commands to the SQL server. yes > > _________________________________________________________________ > > pipe() > diff -urN syslog-ng-1.5.5/src/Makefile.am > syslog-ng-1.5.5a/src/Makefile.am > --- syslog-ng-1.5.5/src/Makefile.am Sun Feb 25 13:00:22 2001 > +++ syslog-ng-1.5.5a/src/Makefile.am Fri Mar 30 17:02:31 2001 > @@ -1,5 +1,5 @@ > ## Run automake to produce Makefile.in > -## $Id: Makefile.am,v 1.43 2001/02/24 12:38:02 bazsi Exp $ > +## $Id: Makefile.am,v 1.44 2001/03/30 15:02:31 bazsi Exp $ > > YFLAGS = @YFLAGS@ > MAKE_CLASS = @MAKE_CLASS@ > @@ -21,7 +21,8 @@ > afstreams.h \ > afprogram.h \ > utils.h \ > - syslog-names.h > + syslog-names.h \ > + nscache.h > > dist_x_files = \ > cfgfile.h.x \ > diff -urN syslog-ng-1.5.5/src/Makefile.in > syslog-ng-1.5.5a/src/Makefile.in > --- syslog-ng-1.5.5/src/Makefile.in Fri Mar 30 14:41:41 2001 > +++ syslog-ng-1.5.5a/src/Makefile.in Fri Mar 30 17:03:22 2001 > @@ -71,7 +71,7 @@ > > SUBDIRS = . tests > > -dist_h_files = syslog-ng.h cfgfile.h > sources.h center.h filters.h destinations.h > log.h afinter.h affile.h afsocket.h > afuser.h afstreams.h afprogram.h utils.h > syslog-names.h > +dist_h_files = syslog-ng.h cfgfile.h > sources.h center.h filters.h destinations.h > log.h afinter.h affile.h afsocket.h > afuser.h afstreams.h afprogram.h utils.h > syslog-names.h nscache.h > > > dist_x_files = cfgfile.h.x destinations.h.x > log.h.x sources.c.x sources.h.x cfgfile.h.x > center.h.x center.c.x afsocket.h.x afsocket.c.x > afunix.c.x afinet.c.x affile.c.x afuser.c.x > afstreams.c.x afprogram.c.x filters.h.x > filters.c.x main.c.x > diff -urN syslog-ng-1.5.5/src/nscache.h syslog-ng-1.5.5a/src/nscache.h > --- syslog-ng-1.5.5/src/nscache.h Thu Jan 1 01:00:00 1970 > +++ syslog-ng-1.5.5a/src/nscache.h Mon Mar 19 15:13:47 2001 > @@ -0,0 +1,24 @@ > +#ifndef __NSCACHE_H > +#define __NSCACHE_H > + > +#include <config.h> > + > +#if WITH_DEBUG > +#define NSCACHE_DEBUG > +#endif > + > +#include <netinet/in.h> > + > +struct nscache; > + > +struct nscache * nscache_new(int size, int expire, int > expire_failed); > +void nscache_free(struct nscache *); > +char * nscache_lookup(struct nscache *, struct in_addr); > + > +#ifdef NSCACHE_DEBUG > +void nscache_dump(struct nscache *); > +#else > +#define nscache_dump(cache) {} > +#endif > + > +#endif > diff -urN syslog-ng-1.5.5/syslog-ng.spec > syslog-ng-1.5.5a/syslog-ng.spec > --- syslog-ng-1.5.5/syslog-ng.spec Fri Mar 30 14:15:52 2001 > +++ syslog-ng-1.5.5a/syslog-ng.spec Fri Mar 30 17:03:07 2001 > @@ -1,5 +1,5 @@ > %define name syslog-ng > -%define version 1.5.5 > +%define version 1.5.5a > %define release 0 > %define prefix /usr > > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD > 804E C82C 8EB1 > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1

syslog-ng 1.5.5 compilation trouble
by Ohrberg, Mick 30 Mar '01

30 Mar '01

Hmm, Maybe I'm just messing up horribly on this wonderful Friday morning. I can't compile syslog-ng 1.5.5! ... checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking libol version >= 0.2.22... ./configure: !: not found ok updating cache ./config.cache ... Woah there! I DO have libol 0.2.22 installed! I found a problem in my configure... Anyone else run into this problem? Instead of doing if ! test -x ... I changed it to if [ ! -x ... ]; do in a few select places. That gets the configure through. I still can't compile though. # make Making all in src make all-recursive Making all in . make: Fatal error: Don't know how to make target `nscache.h' Current working directory /root/Projects/syslog-ng-1.5.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /root/Projects/syslog-ng-1.5.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /root/Projects/syslog-ng-1.5.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Am I just being really stupid? *scratches head* Let me know if anyone have this problem and if there's a patch to fix it. :) Thanks all! Regards, -- Mick Öhrberg Open Systems Administrator, UMB Bank na [NYSE:UMBF] Ph: (816)860-1064 Fax: (816)860-3934 PGP: http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0xD98D5C7B

2 1

RE: [syslog-ng]syslog-ng 1.5.5 and libol 0.2.22 released
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 30 Mar '01

30 Mar '01

Bazsi, I would be willing to spend some time updating the docs. It really needs to be done. Any info you wanted to pass on to make the job simpler would be helpful. Drew > -----Original Message----- > From: Balazs Scheidler [SMTP:bazsi@balabit.hu] > Sent: Friday, March 30, 2001 3:14 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]syslog-ng 1.5.5 and libol 0.2.22 released > > Hi, > > I've released syslog-ng 1.5.5 and the corresponding libol 0.2.22 with the > following changes: > > News for the 1.5.5 release > Fri, 30 Mar 2001 14:23:55 +0200 > > * Fixed a bug in -HUP handling (implemented a cleaner solution, > though less tested than in 1.4.11). > * Added DNS cache implemented by Gael Roualland. > * Added klogctl program to control kernel logging level on Linux > (to make it easier to set up a completely klogd-less logging) > * Template support for output files. > * Documentation somewhat updated. > > > some of these functions were implemented in 1.5.3 but that version didn't > have a NEWS entry, that's why I added it here. Somebody requested that > syslog-ng should make it possible to escape templated output files, it's > now > possible with the template-escape() option. I've updated the docs, though > my > changes touch only the surface. > > Any help for updating the documentation is welcome. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1

1 0

syslog-ng 1.5.5 and libol 0.2.22 released
by Balazs Scheidler 30 Mar '01

30 Mar '01

Hi, I've released syslog-ng 1.5.5 and the corresponding libol 0.2.22 with the following changes: News for the 1.5.5 release Fri, 30 Mar 2001 14:23:55 +0200 * Fixed a bug in -HUP handling (implemented a cleaner solution, though less tested than in 1.4.11). * Added DNS cache implemented by Gaël Roualland. * Added klogctl program to control kernel logging level on Linux (to make it easier to set up a completely klogd-less logging) * Template support for output files. * Documentation somewhat updated. some of these functions were implemented in 1.5.3 but that version didn't have a NEWS entry, that's why I added it here. Somebody requested that syslog-ng should make it possible to escape templated output files, it's now possible with the template-escape() option. I've updated the docs, though my changes touch only the surface. Any help for updating the documentation is welcome. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Syslog-ng newer versions
by Simeon Johnston 30 Mar '01

30 Mar '01

Is there any difference in the way the config file is setup between 1.4.11 and newer 1.5.x versions? I realize that there are new functions and capabilities but will I just be able to plug in my old config file and it will work exactly the same? sim

2 1

Libol version and 1.5.3
by Simeon Johnston 29 Mar '01

29 Mar '01

I am trying to compile syslog-ng 1.5.3 but on your site it is grouped with libol 0.2.20. Syslog-ng 1.4.11 uses libol 0.2.21. Is there a difference? Do I have to use 0.2.20 instead of 0.2.21 or do I just need to redirect Syslog-ng to the different version? I tried to just make it but it didn't find libol 0.2.21 which is why I was wondering. sim

2 2

Syslog Logging Delay
by Brian E. Seppanen 29 Mar '01

29 Mar '01

I'm running syslog-ng 1.4.11 on a redhat-7.0 box. The box is a dual processer PIII 500 dell poweredge 1300, with 512MB of RAM. We're making this baby hum, but may have too much on it. My config is big so i'll include what I think are the relevent portions. Let me know if I'm missing something. Basically syslog-ng has stopped logging at various times. I've been doing a lot of poking today, to stress test it. I'm doing a tcpdump on port 514 and I'm seeing lots of traffic. However, the logs where the information should be going isn't getting updated. My last log entry is from approximatet 2:53 p.m. EST, and it's now 3:25 p.m. EST. If I stop syslog-ng and restart it will probably start logging just fine, but I can't be starting and stopping every three hours. I'm sure it's probably a misconfiguration. netstat -an has remained the same for this span of time as follows Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State udp 65488 0 0.0.0.0:514 0.0.0.0:* Notice the lot in the recv queue. Okay now here's my config. You promise not to laugh right? :) options { sync(0); time_reopen(10); log_fifo_size(2000); chain_hostnames(no); use_dns(no); gc_idle_threshold(500); gc_busy_threshold(3500); }; Now I'm thinking that there is a setting that I haven't left high enough or low enough. I'm not sure if my logs are blocked because I'm trying to force too much into them or what. Basically if I start syslog-ng I usually have about 500 objects alive, and idle_garbage_collection will run almost constantly. After a long time it isn't unheard of that I have about 2000-3000 objects alive. Is it trying to garbage collect itself to death. I never really got a good indication of how I should set that up. This morning I tried increasing the log_fifo_size to 2000. Is there a setting I should check? What would cause it to block anything from getting written? Actually it has written the information to the logs since I started this message at about 3:27, and it doesn't appear to have dropped anything. Would reducing the fifo_size speed up the commit time? What would delay the commit? I'd appreciate any help. Thanks :) Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

2 2

syslog-ng long_hostsname
by Dennis Kruyt 29 Mar '01

29 Mar '01

Hi, I'm running syslog-ng server with a SSL tunnel to the syslog-ng client's I'm sorting the log files to the following dir destination extern { file( "/var/logs/$HOST/$DAY/$FACILITY.log"); }; That function works fine but in the log file there is the following line: Mar 28 03:01:26 src(a)XXX/ZZZZ.bos.nl proftpd[3808]: XXXX.bos.nl (ZZZZ.bos.nl[195.XX.XX.XX]) - FTP session closed. But i want the same line as with syslog Mar 28 03:01:26 XXX proftpd[3808]: XXXX.bos.nl (ZZZZ.bos.nl[195.XX.XX.XX]) - FTP session closed. So that the log analyzer can do there work, i know that i can put out that function with long_hostnames(off) but then is the sorting function for the directory's also gone is there a solution for this. Dennis Kruyt, ZXFactory BV Telefoonweg 44b 6712 GD EDE The Netherlands T +31 138 693 111 F +31 139 693 042 I www.zxfactory.nl

2 1

1.5.4 or 1.5.3???
by Chad C. Walstrom 29 Mar '01

29 Mar '01

Just wondering about this little discrepency in version numbers. Currently, the Debian package that's floating about on sid is 1.5.4, yet all I can find on your ftp server at ftp.balabit.hu is 1.5.3. Is there some secret CVS repository that the Debian Maintainer has access to? Did 1.5.4 exist at some point and then disappear because of some developer decision? Inquiring minds want to know... ;-) -- Chad Walstrom <chewie(a)wookimus.net> | a.k.a. ^chewie http://www.wookimus.net/ | s.k.a. gunnarr Key fingerprint = B4AB D627 9CBD 687E 7A31 1950 0CC7 0B18 206C 5AFD

2 1

DNS fun
by Glen Williams 29 Mar '01

29 Mar '01

I'm playing with a syslog server that will have quite a number clients. I'm running syslog-ng-1.4.11 on Solaris 8. I've been testing with both use_dns on and off with little success. My destination is destination messages { file("/var/log/$HOST/$FACILITY.$YEAR$MONTH$DAY.$HOUR" create_dirs(yes) ); }; With it on, I get messages in both /var/log/<hostname>/local0..... and /var/log/<IP address>/local0..... The number of messages I get in the IP address directory is small, less than 1%. I just assume that syslog-ng gives up on the dns query and writes $HOST as the IP rather than the hostname. This occurs less when a dns cache is installed, but it's still not great having two log files. It doesn't really seem to be blocking on the lookup failures, as I'm not noticing a timeout happening. To overcome this, I turned use_dns off. I have clients using nsyslog-ng using tcp as the transfer protocol. Now these nsyslog-ng clients are logging to /var/log/<hostname>/local0 and NEVER in /var/log/<IP address>/local0 I want both nsyslog-ng and standard syslog clients to log to the same directory format. I'll settle for the $HOST variable being the IP. What am I missing for nsyslog-ng clients using tcp to do this? Thanks, Glen

1 0

UDP from syslog to syslog-ng
by Brian E. Seppanen 28 Mar '01

28 Mar '01

I'm testing out logging from another host to a central syslog-ng host. The host I'm logging to is a redhat-7.0 linux box with 1.4.11. The host I'm logging from is a Solaris 7 box running sun's standard syslog. I've defined loghost in /etc/hosts, and I've seen a couple of messages arrive. However it's been forever since any messages have been logged from this host. If I do a netstat -an I see the following Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State udp 65520 0 0.0.0.0:514 0.0.0.0:* I have the following source definition source udp_src {udp();} And I'm simply trying to get it to default to a /var/log/messages log { source(udp_src); filter(DEFAULT); destination(messages);}; I'm reading the netstat as indicating the data is being sent, and is being received. However, it's not being written to the files. Other data has been written in the meantime to the log files. We currently are logging several cisco routers with the source: udp_src { udp()}; In fact this was logging messages ealier as well. I've been trying to tweak it a little and now it doesn't seem to be working. Anyone seen this? This is very frustrating. Anyone have any ideas on what I may have done wrong? Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

2 2

RE: 1.5 stable? was(Re: [syslog-ng]Feature Request)
by Andrew Fort 28 Mar '01

28 Mar '01

> How stable is 1.5? This looks like a very cool function that > I would like to be able to use on our logserver. Is it > stable enough for a production environment? I use it in a production environment with 60 or 70 cisco switches and routers spitting syslog at my syslog-ng. I haven't had any dramas (my platform is Linux 2.2.19). memory usage is normal, no leaks evident. -afort

2 1

Feature Request
by Chad C. Walstrom 28 Mar '01

28 Mar '01

Firstly, THANKS for such a great replacement to syslog! I'm quite happy with the ease of configurability and the use of the tcp() source and destinations -- very nice for tunnelling over OpenSSL. Next thing to ask for is a feature request that would make our use of syslog infintely more flexible: a string formatter module. Take this hypothetical syslog-ng.conf entry as an example: --------- START EXAMPLE ----------- # First, set some global options. options { long_hostnames(off); sync(0); }; source remotehost { tcp( 192.168.1.1, 514 ); }; # sql batch file destination sql_output { file ("/var/log/log.sql" owner ("root") group("adm") perm(0640)); }; destination xml_output { file ("/var/log/log.xml" owner ("root") group("adm") perm(0640)); }; # Now, the format string using printf style placeholders where %h == # host, %d == date, %t == time, %f == facility, %l == level, and %m == # message format o_sql { printf( "INSERT mytable ( host, date, time, facility, level, message )\nVALUES ( '%h', '%d', '%t', '%f', '%l', '%m' );\n" ); }; # Or, we could specify template files for the printf driver # # Where the file would contain character literals rather than escapes # (for things such as tab and newline): # # INSERT mytable ( host, date, time, facility, level, message ) # VALUES ( '%h', '%d', '%t', '%f', '%l', '%m' );\n" ); # format o_sql { printf(template("/usr/share/syslog-ng/sql.tmpl")); }; format o_xml { printf(template("/usr/share/syslog-ng/xml.tmpl")); }; # Now, out to the log log { source(remotehost); format(o_sql); destination(sql_output); }; log { source(remotehost); format(o_xml); destination(xml_output); }; --------- START EXAMPLE ----------- The reason I suggest having format as a separate module instead of a file option is for instance you want to have a real-time process to log INSERT statements into a database. You could specificy your destination as a named pipe source s_host{ tcp( 192.168.1.1, 514 ); }; format o_sql{ printf(template("/etc/syslog-ng/custom_sql.tmpl")); }; destination d_sqlpipe{ file("/dev/log_sql" owner ("root") group("adm") perm(0640)); }; log{ source(s_host); format(o_sql); destination(d_sqlpipe); }; to which your database client is listening, waiting for input. Let's hypothise for a moment that psql, the PostgreSQL command line client, can open up a named pipe as an input file -- as I'm not sure if it really can. A command like the following is all you'd need for real-time database logging: bash$ whoami syslogd bash$ nohup psql -h localhost -d sysylogdb /dev/log_sql& bash$ We preserve the UNIX philosophy in that you let your tools do only one job, but one job done VERY well. Why reimplement the wheel and embed an SQL client into syslog-ng? No reason at all. What do we have to do to change the output format? Change the output template in the log rule. Simple, clean, efficient. What do you think? -- Chad Walstrom <chewie(a)wookimus.net> | a.k.a. ^chewie http://www.wookimus.net/ | s.k.a. gunnarr Key fingerprint = B4AB D627 9CBD 687E 7A31 1950 0CC7 0B18 206C 5AFD

2 2

syslog-ng over network
by Mariusz Bogumil 26 Mar '01

26 Mar '01

I try to send messages over network (server which generates messages and workstation which cachets it are in the other subnets) I have tried such configuration: source s_tcp { tcp( ip(10.12.12.2) port(514) ); sun-streams( "dev/log" door("/etc/.syslog_door") ); internal(); }; destination all { tcp("10.13.12.124" port(514) ); }; -- it used to work when server and workstation are in the same network - when they are in different subnets as above it doesn't. I have tried configuration with UDP source s_tcp { udp( ip(10.12.12.2) port(514) ); sun-streams( "dev/log" door("/etc/.syslog_door") ); internal(); }; destination all { udp(10.13.12.124 port(514)); }; but without success - it compiles without error but I cannot cacht any messages. What should be used tcp or udp? Should I define in syslog-ng any knowledge about routers (I do not think so - but who knows ???) I try to run it on Sprac Solaris 2.6 and 7 (but 2.6 is more critical). Thank yu for help Mariusz

1 0

Syslog tunneling
by Dennis 23 Mar '01

23 Mar '01

Hi, I'm trying to setup a secure way of remote logging by means of tunneling. I'm running syslog-ng so I'm able to do remote logging over tcp instead of udp. But the setup is as usual 1 loghost and several others sending all logs to the port the syslog-ng is listening on on the loghost..I was wondering..is it possible to use stunnel somehow to secure the log packets travelling the hostile internet to the loghost? It would mean that there have to be more tunnels from different hosts towards de one logging... Running out of knowledge and before wasting valuable time, i would like to know if there are people who have set up a secure logging facility in the past for syslog-ng? Dennis,

3 2

RE: [syslog-ng]Syslog Chaining doesn't work as expected
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 23 Mar '01

23 Mar '01

keep_hostname(yes) and use_fqdn(yes) actually does make sense. I use these options together and it makes a difference. If I have keep_hostname(yes) and use_fqdn(no), I get messages with such names as gw1, gw2, gw3. I have 14 gw1 hosts in my area of control so needless to say that is not very revealing. If I use keep_hostname(yes) and use_fqdn(yes), I get names like gw1.mydomain.com, and gw1.otherdomain.com. It does make a difference. You certainly don't want to use chain_hostnames(yes) and keep_hostname(yes) those, I believe, are mutually exclusive. Regards, Drew > -----Original Message----- > From: Gregor Binder [SMTP:gbinder@sysfive.com] > Sent: Friday, March 23, 2001 1:31 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Syslog Chaining doesn't work as expected > > Wiktor Wodecki on Fri, Mar 23, 2001 at 01:05:10PM +0100: > > Hi Wiktor, > > > > depending on how your systems are configured, you might get good > > > results with turning keep_hostname on if that's an option. > > > > nope, that didn't do it, it still writes logs with canonical name and > > not the fqdn. > > well, I could've said that before, it would require your systems know > themselves by their FQDN (and use this name for their log messages). > > > > - Do you use FQDNs in /etc/hosts? > > > > yes, on LOGGINGSERVER, not on GATESERVER > > If I understand your setup correctly, DNS config on GATESERVER (or how > names get resolved and all that) matters, so you do want to make sure > the log clients that go through GATESERVER can be properly qualified. > > > options { long_hostnames(yes); sync(2); use_dns(yes); use_fqdn(yes); > > create_dirs(yes); log_fifo_size(1000); time_reopen(2); > > chain_hostnames(yes); keep_hostname(yes); }; > > keep_hostname(yes) does not make sense with use_dns(yes) and > use_fqdn(yes) since it means "keep the hostname that the log message > contains". IIRC long_hostnames is just an alias for use_fqdn. > > I think you want the following options (besides those not related to > DNS/hostnames): > > LOGGINGSERVER: keep_hostname(yes); chain_hostnames(no); use_fqdn(yes); > GATESERVER: use_dns(yes); use_fqdn(yes); > > And make sure GATESERVER can determine FQDNs. > > If you have clients logging directly to LOGGINGSERVER, you might want to > check if you can specify those options in the source and not global, > since otherwise you would get inconsistent naming. I am not sure if you > can do that though. > > Greetings, > > -- > Gregor Binder <gregor.binder(a)sysfive.com> http://sysfive.com/ > sysfive.com GmbH UNIX. Networking. Security. Applications. > PGP id: 0x20C6DA55 fp: 18AB 2DD0 F8FA D710 1EDC A97A B128 01C0 20C6 DA55 > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Syslog Chaining doesn't work as expected
by Wiktor Wodecki 23 Mar '01

23 Mar '01

Hello folks, I've got a problem with chaining syslog messages. Basically I try to forward syslog messages via a host to our loggingserver, but the loggingserver doesn't get that's it's from an other host and not the "forwarder". Here is my setup: LOGGINSERVER (valid IP adress) | | GATESERVER (valid IP adress + internal 192.x.x.x adress on second nic) | | SERVER (internet IP) Gateserver and Server both shall log to LOGGINGSERVER. This is my logserver setup: options { long_hostnames(yes); sync(0); time_reap(1); use_time_recvd(yes); use_dns(yes); use_fqdn(yes); create_dirs(yes); log_fifo_size(10000); chain_hostnames(no); }; source frontier { tcp(ip(xx.xxx.x.xxx) port(540) max-connections (20)); } destination blackhole { file("/var/log/frontier/$YEAR$MONTH/$HOST"); }; log { source(frontier); destination(blackhole); } as you see it logs everything from a connecting host to an own file. If I forward the logs from SERVER via GATESERVER, the loggingserver writes all logfiles of SERVER to the logfile of GATESERVER since it sees it coming from the IP. That's correct and that's how it supposed to work (documentation). now if I switch the option chain_hostnames to yes it does what I want, it writes an own logfile for SERVER. However, it stops writing fqdn's and start writing the logs with the canonical name of the machines. An example: Before I turn chain_hostnames to yes it logs file from the machine abc.de.fg to a file called "abc.de.fg" - If I turn the option on it starts logging to the file "abc". Since I have many machines with the same name but with different fqdn's I can't use that. Since I've turned on logn_hostnames and use_fqdn I'm a bit curious what to do. Is this a bug or did I miss an option in the docs? All hosts are in /etc/hosts on the Loggingserver and all three machines use current stable release 1.4.11. Thanks in advance for the help -- Regards, Wiktor Wodecki, Unix Administration | Wapme-Systems AG Tel.: +49-211-748450 | Muensterstrasse 248 Fax: +49-211-74845176 | 40470 Duesseldorf E-Mail: wodecki(a)wapme-systems.de | http://www.wapme-systems.de 1024/E22253B9 084C 7950 4D65 0E92 46D1 48AF F3F7 3201 E222 53B9

2 3

creation of filter
by pierrick le fol 22 Mar '01

22 Mar '01

I will wish to write a script to filter the event of my equipment by address IP. But I cannot program in Shell. If anyone has any ideas, please forward them to me also. Thanks Pierrick

2 1

RE: [syslog-ng]Re: desperatly need your help
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 22 Mar '01

22 Mar '01

I tested this on my Solaris 7 machine and it worked as expected. I used version 1.5.3 and libol version 0.2.21. So whatever it is it is not Solaris 7. Regards, Drew > -----Original Message----- > From: Balazs Scheidler [SMTP:bazsi@balabit.hu] > Sent: Wednesday, March 21, 2001 4:48 PM > To: Mariusz Bogumil > Cc: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Re: desperatly need your help > > On Wed, Mar 21, 2001 at 03:31:16PM +0100, Mariusz Bogumil wrote: > > I think that I really desperatly need your help. I have tested all > > possible configuration and I still cannot filter messages from snort > > from my /var/log/messages and I start thinking that such configuration > > is impossible. Please tell me what I am doing wrong. > > > > To this mail I attach my syslog-ng.conf - with only with lines that > > describe my problem and complete config too. > > > > I run it on Sprac Solaris 7 > > I tried the following configuration: > > source src { unix-stream("log"); internal(); }; > > destination d1 { file("d1"); }; > destination d2 { file("d2"); }; > destination d3 { file("d3"); }; > > filter fn_snort { not match("snort"); }; > filter f_snort { match("snort"); }; # it works > > log { source(src); filter(fn_snort); destination(d1); }; > log { source(src); filter(f_snort); destination(d2); }; > log { source(src); destination(d3); }; > > and I sent the following log messages: > > logger -u log "valami" > logger -u log -t snort hallo > > It correctly sent messages to their appropriate destination. I suspect a > bug > in either Solaris or in Solaris/syslog-ng interoperation. Could anybody > check this? > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0