- syslog-ng - lists.balabit.hu

Re: [syslog-ng]Hostname determination and AIX
by John_Delisle＠ceridian.ca 21 Mar '01

21 Mar '01

I've run into the same irritating problem with IBM's non-standard syslogd. If anyone has any ideas, please forward them to me also. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Jon Marks <j-marks(a)uiuc.edu> To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: [syslog-ng]Hostname determination and AIX balabit.hu 2001/03/21 03:44 PM Please respond to syslog-ng Hello, I saw this issue arose previously in the mailing list, but I'm not sure what the resolution was. I'm running syslog-ng 1.4.11 on AIX 4.3.3. This machine is meant to be a loghost for a number of different kinds of systems including other AIX boxes. I'd like to organize messages into a directory structure on a per-host basis (a typical syslog-ng use, I assume). The trouble is that the hostname is improperly interpreted upon receipt of messages from other AIX machines. Thus, strange output files appear. The following is a sample of my syslog-ng.conf: ###################################################################### source s_ccso { unix-dgram("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; destination d_psg_connections { file("/services/syslog/systems/$HOST/connections-$YEAR$MONTH$DAY" owner(psg) group(psg) perm(0600) dir_perm(0755) create_dirs(yes)); }; filter f_psg_connections { facility(local3) and level(info); }; log { source(s_ccso); filter(f_psg_connections); destination(d_psg_connections); }; ###################################################################### Using a test program, I generate a bunch of messages on a remote AIX client host that end up looking like this (at LOCAL3.INFO) in the *remote client* log: Mar 21 15:06:44 vader TEST[4234]: (0) TEST MESSAGE (0) Mar 21 15:06:44 vader TEST[4234]: (1) TEST MESSAGE (1) Mar 21 15:06:44 vader TEST[4234]: (2) TEST MESSAGE (2) Mar 21 15:06:44 vader TEST[4234]: (3) TEST MESSAGE (3) Mar 21 15:06:44 vader TEST[4234]: (4) TEST MESSAGE (4) Mar 21 15:06:44 vader TEST[4234]: (5) TEST MESSAGE (5) Mar 21 15:06:44 vader TEST[4234]: (6) TEST MESSAGE (6) Mar 21 15:06:44 vader TEST[4234]: (7) TEST MESSAGE (7) Mar 21 15:06:44 vader TEST[4234]: (8) TEST MESSAGE (8) Mar 21 15:06:44 vader TEST[4234]: (9) TEST MESSAGE (9) Mar 21 15:06:44 vader TEST[4234]: REPS: 10 Time: 0 s 1 ms 886 us The remote host (vader) sends these to the loghost, as well; but rewrites them since that's what AIX's syslogd does. They land in the following location on the loghost: /services/syslog/systems/From/connections-20010321 ^^^^ Note the incorrect hostname. This is what they look like inside that particular log: Mar 21 15:06:44 From/vader vader: TEST[4234]: (0) TEST MESSAGE (0) Mar 21 15:06:44 From/vader vader: TEST[4234]: (1) TEST MESSAGE (1) Mar 21 15:06:44 From/vader vader: TEST[4234]: (2) TEST MESSAGE (2) Mar 21 15:06:44 From/vader vader: TEST[4234]: (3) TEST MESSAGE (3) Mar 21 15:06:44 From/vader vader: TEST[4234]: (4) TEST MESSAGE (4) Mar 21 15:06:44 From/vader vader: TEST[4234]: (5) TEST MESSAGE (5) Mar 21 15:06:44 From/vader vader: TEST[4234]: (6) TEST MESSAGE (6) Mar 21 15:06:44 From/vader vader: TEST[4234]: (7) TEST MESSAGE (7) Mar 21 15:06:44 From/vader vader: TEST[4234]: (8) TEST MESSAGE (8) Mar 21 15:06:44 From/vader vader: TEST[4234]: (9) TEST MESSAGE (9) Mar 21 15:06:44 From/vader vader: TEST[4234]: REPS: 10 Time: 0 s 1 ms 886 us ^^^^ Notice how the word "From" squeezes its way into the hostname. This is what the log would have looked like if done by AIX's native syslogd: Mar 21 15:19:39 vader From vader: TEST[4248]: (0) TEST MESSAGE (0) Mar 21 15:19:39 vader From vader: TEST[4248]: (2) TEST MESSAGE (2) Mar 21 15:19:39 vader From vader: TEST[4248]: (1) TEST MESSAGE (1) Mar 21 15:19:39 vader From vader: TEST[4248]: (3) TEST MESSAGE (3) Mar 21 15:19:39 vader From vader: TEST[4248]: (4) TEST MESSAGE (4) Mar 21 15:19:39 vader From vader: TEST[4248]: (5) TEST MESSAGE (5) Mar 21 15:19:39 vader From vader: TEST[4248]: (6) TEST MESSAGE (6) Mar 21 15:19:39 vader From vader: TEST[4248]: (7) TEST MESSAGE (7) Mar 21 15:19:39 vader From vader: TEST[4248]: (8) TEST MESSAGE (8) Mar 21 15:19:39 vader From vader: TEST[4248]: (9) TEST MESSAGE (9) Mar 21 15:19:39 vader From vader: TEST[4248]: REPS: 10 Time: 0 s 1 ms 923 us So the "From" comes out of what AIX's syslogd sends to the loghost when it forwards its own messags. This particular format is what you get when you run AIX's syslogd with the '-s' command-line option; normally it's even more obnoxious (I learned this on this mailing list). This more verbose, obnoxious output causes the same problem. I'll use it to make another quick example of the problem. This is from the same AIX client running native syslogd without '-s': On the client (remote host): Mar 21 15:30:28 vader TEST[4270]: (1) TEST MESSAGE (1) Mar 21 15:30:28 vader TEST[4270]: (2) TEST MESSAGE (2) On the loghost (running AIX's syslogd): Mar 21 15:30:28 vader Message forwarded from vader: TEST[4270]: (0) TEST MESSAGE (0) Mar 21 15:30:28 vader Message forwarded from vader: TEST[4270]: (1) TEST MESSAGE (1) A similar example, on the loghost running syslog-ng (these are mistakenly located in /services/syslog/systems/Message/connections-20010321): ^^^^^^^ Mar 21 15:34:33 Message/vader forwarded from vader: TEST[4282]: (0) TEST MESSAGE (0) Mar 21 15:34:33 Message/vader forwarded from vader: TEST[4282]: (1) TEST MESSAGE (1) ^^^^^^^ Notice both AIX's obnoxious message prefix string and how syslog-ng handles it when interpreting the hostname. This server will be hosting logs for lots of people's machines; I can't mandate that everybody uses syslog-ng. Some people are going to run AIX boxes and so I'll have to put up with these kinds of messages. Is there anything syslog-ng can do? Is this addressed in the development version? Thanks for your help! -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Hostname determination and AIX
by Jon Marks 21 Mar '01

21 Mar '01

Hello, I saw this issue arose previously in the mailing list, but I'm not sure what the resolution was. I'm running syslog-ng 1.4.11 on AIX 4.3.3. This machine is meant to be a loghost for a number of different kinds of systems including other AIX boxes. I'd like to organize messages into a directory structure on a per-host basis (a typical syslog-ng use, I assume). The trouble is that the hostname is improperly interpreted upon receipt of messages from other AIX machines. Thus, strange output files appear. The following is a sample of my syslog-ng.conf: ###################################################################### source s_ccso { unix-dgram("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; destination d_psg_connections { file("/services/syslog/systems/$HOST/connections-$YEAR$MONTH$DAY" owner(psg) group(psg) perm(0600) dir_perm(0755) create_dirs(yes)); }; filter f_psg_connections { facility(local3) and level(info); }; log { source(s_ccso); filter(f_psg_connections); destination(d_psg_connections); }; ###################################################################### Using a test program, I generate a bunch of messages on a remote AIX client host that end up looking like this (at LOCAL3.INFO) in the *remote client* log: Mar 21 15:06:44 vader TEST[4234]: (0) TEST MESSAGE (0) Mar 21 15:06:44 vader TEST[4234]: (1) TEST MESSAGE (1) Mar 21 15:06:44 vader TEST[4234]: (2) TEST MESSAGE (2) Mar 21 15:06:44 vader TEST[4234]: (3) TEST MESSAGE (3) Mar 21 15:06:44 vader TEST[4234]: (4) TEST MESSAGE (4) Mar 21 15:06:44 vader TEST[4234]: (5) TEST MESSAGE (5) Mar 21 15:06:44 vader TEST[4234]: (6) TEST MESSAGE (6) Mar 21 15:06:44 vader TEST[4234]: (7) TEST MESSAGE (7) Mar 21 15:06:44 vader TEST[4234]: (8) TEST MESSAGE (8) Mar 21 15:06:44 vader TEST[4234]: (9) TEST MESSAGE (9) Mar 21 15:06:44 vader TEST[4234]: REPS: 10 Time: 0 s 1 ms 886 us The remote host (vader) sends these to the loghost, as well; but rewrites them since that's what AIX's syslogd does. They land in the following location on the loghost: /services/syslog/systems/From/connections-20010321 ^^^^ Note the incorrect hostname. This is what they look like inside that particular log: Mar 21 15:06:44 From/vader vader: TEST[4234]: (0) TEST MESSAGE (0) Mar 21 15:06:44 From/vader vader: TEST[4234]: (1) TEST MESSAGE (1) Mar 21 15:06:44 From/vader vader: TEST[4234]: (2) TEST MESSAGE (2) Mar 21 15:06:44 From/vader vader: TEST[4234]: (3) TEST MESSAGE (3) Mar 21 15:06:44 From/vader vader: TEST[4234]: (4) TEST MESSAGE (4) Mar 21 15:06:44 From/vader vader: TEST[4234]: (5) TEST MESSAGE (5) Mar 21 15:06:44 From/vader vader: TEST[4234]: (6) TEST MESSAGE (6) Mar 21 15:06:44 From/vader vader: TEST[4234]: (7) TEST MESSAGE (7) Mar 21 15:06:44 From/vader vader: TEST[4234]: (8) TEST MESSAGE (8) Mar 21 15:06:44 From/vader vader: TEST[4234]: (9) TEST MESSAGE (9) Mar 21 15:06:44 From/vader vader: TEST[4234]: REPS: 10 Time: 0 s 1 ms 886 us ^^^^ Notice how the word "From" squeezes its way into the hostname. This is what the log would have looked like if done by AIX's native syslogd: Mar 21 15:19:39 vader From vader: TEST[4248]: (0) TEST MESSAGE (0) Mar 21 15:19:39 vader From vader: TEST[4248]: (2) TEST MESSAGE (2) Mar 21 15:19:39 vader From vader: TEST[4248]: (1) TEST MESSAGE (1) Mar 21 15:19:39 vader From vader: TEST[4248]: (3) TEST MESSAGE (3) Mar 21 15:19:39 vader From vader: TEST[4248]: (4) TEST MESSAGE (4) Mar 21 15:19:39 vader From vader: TEST[4248]: (5) TEST MESSAGE (5) Mar 21 15:19:39 vader From vader: TEST[4248]: (6) TEST MESSAGE (6) Mar 21 15:19:39 vader From vader: TEST[4248]: (7) TEST MESSAGE (7) Mar 21 15:19:39 vader From vader: TEST[4248]: (8) TEST MESSAGE (8) Mar 21 15:19:39 vader From vader: TEST[4248]: (9) TEST MESSAGE (9) Mar 21 15:19:39 vader From vader: TEST[4248]: REPS: 10 Time: 0 s 1 ms 923 us So the "From" comes out of what AIX's syslogd sends to the loghost when it forwards its own messags. This particular format is what you get when you run AIX's syslogd with the '-s' command-line option; normally it's even more obnoxious (I learned this on this mailing list). This more verbose, obnoxious output causes the same problem. I'll use it to make another quick example of the problem. This is from the same AIX client running native syslogd without '-s': On the client (remote host): Mar 21 15:30:28 vader TEST[4270]: (1) TEST MESSAGE (1) Mar 21 15:30:28 vader TEST[4270]: (2) TEST MESSAGE (2) On the loghost (running AIX's syslogd): Mar 21 15:30:28 vader Message forwarded from vader: TEST[4270]: (0) TEST MESSAGE (0) Mar 21 15:30:28 vader Message forwarded from vader: TEST[4270]: (1) TEST MESSAGE (1) A similar example, on the loghost running syslog-ng (these are mistakenly located in /services/syslog/systems/Message/connections-20010321): ^^^^^^^ Mar 21 15:34:33 Message/vader forwarded from vader: TEST[4282]: (0) TEST MESSAGE (0) Mar 21 15:34:33 Message/vader forwarded from vader: TEST[4282]: (1) TEST MESSAGE (1) ^^^^^^^ Notice both AIX's obnoxious message prefix string and how syslog-ng handles it when interpreting the hostname. This server will be hosting logs for lots of people's machines; I can't mandate that everybody uses syslog-ng. Some people are going to run AIX boxes and so I'll have to put up with these kinds of messages. Is there anything syslog-ng can do? Is this addressed in the development version? Thanks for your help! -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign

1 0

Re: desperatly need your help
by Balazs Scheidler 21 Mar '01

21 Mar '01

On Wed, Mar 21, 2001 at 03:31:16PM +0100, Mariusz Bogumil wrote: > I think that I really desperatly need your help. I have tested all > possible configuration and I still cannot filter messages from snort > from my /var/log/messages and I start thinking that such configuration > is impossible. Please tell me what I am doing wrong. > > To this mail I attach my syslog-ng.conf - with only with lines that > describe my problem and complete config too. > > I run it on Sprac Solaris 7 I tried the following configuration: source src { unix-stream("log"); internal(); }; destination d1 { file("d1"); }; destination d2 { file("d2"); }; destination d3 { file("d3"); }; filter fn_snort { not match("snort"); }; filter f_snort { match("snort"); }; # it works log { source(src); filter(fn_snort); destination(d1); }; log { source(src); filter(f_snort); destination(d2); }; log { source(src); destination(d3); }; and I sent the following log messages: logger -u log "valami" logger -u log -t snort hallo It correctly sent messages to their appropriate destination. I suspect a bug in either Solaris or in Solaris/syslog-ng interoperation. Could anybody check this? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

not match problem once again
by Mariusz Bogumil 21 Mar '01

21 Mar '01

I have searched the whole archive but I have not found any solution to my problem. ----------------- destination messages { file("/var/log/messages.log"); }; filter f_messages { level(info..warn) and not macht("snort") and not facility(auth, news, mail); }; log { source(s_tcp); filter(f_messages); destination(messages); }; ---------------------- I want logs that contain word "snort" not to be directed to /var/log/messages but it seems that filter not match("snort") does not work. Thank you in advance for your help marbo

3 2

logging from 20 hosts
by Dennis Kruyt 20 Mar '01

20 Mar '01

Hi, What sould be the best solution with syslog-ng for logging about 20 hosts to one log machine and to sort them on that machine. Has someone done this before???? Dennis Kruyt, ZXFactory BV Telefoonweg 44b 6712 GD EDE The Netherlands T +31 138 693 111 F +31 139 693 042 I www.zxfactory.nl

3 2

RE: [syslog-ng]logging from 20 hosts
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 20 Mar '01

20 Mar '01

I log about 1000 machines to one loghost using syslog-ng. Would you count that? What do you want to do? Regards, Drew > -----Original Message----- > From: Dennis Kruyt [SMTP:d.kruyt@zx.nl] > Sent: Tuesday, March 20, 2001 2:55 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]logging from 20 hosts > > Hi, > > What sould be the best solution with syslog-ng for logging about 20 hosts > to one log machine and to sort them on that machine. Has someone done this > before???? > > Dennis Kruyt, > > ZXFactory BV > Telefoonweg 44b > 6712 GD EDE > The Netherlands > T +31 138 693 111 > F +31 139 693 042 > I www.zxfactory.nl <http://www.zxfactory.nl> >

1 0

Multiple udp sources
by John_Delisle＠ceridian.ca 19 Mar '01

19 Mar '01

Can I use multiple UDP sources? I'd like to listen on 2 ports. I've tried configuring this, but no luck. I don't seem to get any messages. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909

1 0

Logwatch and syslog-ng
by Simeon Johnston 17 Mar '01

17 Mar '01

Has anyone configured logwatch to work with syslog-ng ( or the reverse )? I am trying to keep the originating host in the logs but logwatch seems to strip all relevant information from the log files. Has anyone done anything like this? sim

1 0

1.4.11 fixes SIGHUP problems?
by Balazs Scheidler 16 Mar '01

16 Mar '01

Hi, I was wondering whether the 1.4.11 release did really fix the SIGHUP problems many of you encountered? Some feedback would be useful. TIA, -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 2

Ofer Aaronson/AME/APPLIED MATERIALS - Out from the office
by Out_Of_Office＠amat.com 14 Mar '01

14 Mar '01

**PLEASE DO NOT REPLY TO THIS MESSAGE** I will be out of the office from 03/12/2001 until 03/15/2001. Hello Everybody , I will be out from the office for training. Please contact Ed Shyng (x31921 or 408 563 1921) for any Data Network Operations issues . If you need to reach me, please leave me Email or Vmail and I'll try to return back to you within a 24h window. Thanks , Ofer Aaronson .

1 0

partition full
by Torsten Curdt 13 Mar '01

13 Mar '01

can syslog-ng be configured to check for enough logging space? It would be cool to be able to start a script if the free space of the log partition drops under x percent. -- Torsten

2 1

RE: [syslog-ng]1.4.11 fixes SIGHUP problems?
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 13 Mar '01

13 Mar '01

I definitely agree that there is nothing more that can be done. I write my internal() source to a different file and after I HUP the daemon I just tail the file and I know whether the config was any good. You could write a wrapper script that HUPped the daemon and tailed the output of your internal file all for you on restart. That would at least give you immediate gratification, which is what this is all about anyway, right? Regards, Drew > -----Original Message----- > From: Scott McDermott [SMTP:mcdermot@questra.com] > Sent: Monday, March 12, 2001 10:10 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]1.4.11 fixes SIGHUP problems? > > Balazs Scheidler on Mon 12/03 19:07 +0100: > > > Can't you just write it to the internal source ? > > > > I _write_ it there, that's why it pops up in logs. > > Then there's nothing more that can be done :) Person in question will > just have to maintain a regex watcher on the logs for failures. Since > syslog-ng closes all its terminal-inherited FDs, forks and sets SID, I > don't see where else it would go...I mean you could write it to > /dev/console but that's icky. > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]1.4.11 fixes SIGHUP problems?
by John_Delisle＠ceridian.ca 12 Mar '01

12 Mar '01

Would it make sense then to also send it to: destination d_mlal { usertty("*"); }; or destination d_cons { file("/dev/console"); }; John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Balazs Scheidler <bazsi(a)balabit.hu> To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: Re: [syslog-ng]1.4.11 fixes SIGHUP problems? balabit.hu 2001/03/12 11:57 AM Please respond to syslog-ng On Mon, Mar 12, 2001 at 12:49:40PM -0500, William Yodlowsky wrote: > On Mon, Mar 12, 2001 at 12:47:33PM -0500, jon(a)dumbo.pobox.com wrote: > > IMO, it should dump to STDOUT/ERR as well...much like apachectl restart. > > > > apache says something like "config is broken, ignoring restart" > > > > i've made changes to the config file before(with errors) never thinking there's a problem. > > logging continued normally, not error messages i could see. > > I'm afraid I agree totally with this... I've done the same thing. You could tell me a clue _where_ I could write this message? syslog-ng is running in the background with no stderr or stdout. It has nothing to write to except for its logfiles. As I see Apache has a configtest mode which is ran prior to sending a signal to the daemon, and although this can be done with syslog-ng as well, the configuration can be broken even if it's syntactically correct. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]1.4.11 fixes SIGHUP problems?
by John_Delisle＠ceridian.ca 12 Mar '01

12 Mar '01

I'd say it does make sense, but the point was that not starting with a broken config wasn't a bug. Output to stderr would be fantastic. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 William Yodlowsky <wyodlows(a)andromeda.ru To: syslog-ng(a)lists.balabit.hu tgers.edu> cc: Sent by: Subject: Re: [syslog-ng]1.4.11 fixes SIGHUP problems? syslog-ng-admin@lists. balabit.hu 2001/03/12 11:49 AM Please respond to syslog-ng On Mon, Mar 12, 2001 at 12:47:33PM -0500, jon(a)dumbo.pobox.com wrote: > IMO, it should dump to STDOUT/ERR as well...much like apachectl restart. > > apache says something like "config is broken, ignoring restart" > > i've made changes to the config file before(with errors) never thinking there's a problem. > logging continued normally, not error messages i could see. I'm afraid I agree totally with this... I've done the same thing. > not many people will want to have to check a log file after a restart, they may think > "telling it to HUP, didn't report any errors, and my other logs are still there..." > > On Mon, Mar 12, 2001 at 11:33:35AM -0600, John_Delisle(a)ceridian.ca wrote: > | > | > | I'm not sure thats a bug, it may be a feature actually. If you look at > | /var/log/messages, theres an entry saying the new config is bad, and > | syslog-ng will continue running with the old config. This prevents lost > | syslog messages. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Question...
by Simeon Johnston 11 Mar '01

11 Mar '01

I am setting up a bunch of computers to send there logs to a logserver. I have it set up pretty well and finally figured out the network issue. Everything works great. I was wondering about how daemons send there logs to syslog/syslog-ng. Do all daemons send there logs through the kernel/klogd or do some of them send there logs directly to syslog? If I stop syslog will they start to send them to syslog-ng? Also I am having trouble with the rules for syslog-ng.conf. If I tell it to send everything with a priority of emerg through debug it should send everything right? I am not receiving some logs that are being picked up by syslog. Do some logs not have a priority? How do I tell syslog-ng just to send everything to the logserver? No filters? It might not work too well because of the volume of logs but I would like to try it. BTW Is there going to be an updated manual anytime soon? The current one is not very helpfull. sim

1 0

(no subject)
by jansa＠udba.org 11 Mar '01

11 Mar '01

1 0

Re: syslog-ng suggestion
by Balazs Scheidler 09 Mar '01

09 Mar '01

On Mon, Mar 05, 2001 at 06:09:19PM -0600, Lee Eakin wrote: > Well, it appears the I did not include the attachment (patch) which was the > whole point of the message. My apologies if I DID include it and this is > just wasted bandwidth. Sorry for not reacting your message sooner. > > For instance, 'logger test' prints: > > > > Mar 2 20:18:15 japh[user,notice] logger: test > > > > My patch is against 1.4.11 (current stable).I hope you will consider it's > > inclusion, or some variation of this patch. You can achieve the same by using a release in the new 1.5.x branch, and using the template() feature of file destinations like this: destination d_file { file("/var/log/messages" template("$DATE $HOST[$FACILITY,$PRIORITY] $PROGRAM $MSG\n"); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

Re: [syslog-ng]Re:restarting syslog-ng
by John_Delisle＠ceridian.ca 09 Mar '01

09 Mar '01

You may see it mentioned as SIGHUP (same thing). Take a look at man 7 signal. It covers them all. Also, does syslog-ng re-create files if you remove them and send it a SIGHUP? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 jmad <than(a)wwa.com> Sent by: To: syslog-ng(a)lists.balabit.hu syslog-ng-admin@lists. cc: balabit.hu Subject: [syslog-ng]Re:restarting syslog-ng 2001/03/08 12:05 PM Please respond to syslog-ng I saw the e-mail below and have a question: I'm currently using Caldera's Linux to host my syslog-ng. I currently use a cron script similar to below to stop, rotate my logs and restart the service (obviously not ideal, there's a brief moment where I lose messages). When I look at the man page for kill I do not see a -HUP switch. Does anyone know if this is just an undocumented option, or is it not available? If not, any ideas on what I can do to fix this? Thanks for any help you can provide, JonM Balazs Scheidler wrote: > > I'm trying to set up syslog-ng to rotate it's logs with logrotate. One > > question this brings to mind is whether syslog-ng will restart with the > > HUP signal. > > > > #/bin/kill -HUP `cat /var/run/syslog-ng.pid` > > yes. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

restarting syslog-ng
by Brian E. Seppanen 08 Mar '01

08 Mar '01

I'm trying to set up syslog-ng to rotate it's logs with logrotate. One question this brings to mind is whether syslog-ng will restart with the HUP signal. #/bin/kill -HUP `cat /var/run/syslog-ng.pid` Thanks, Brian Seppanen Charter Communications Regional Data Center 906-228-3100 ext 23 Marquette, MI seppy(a)chartermi.net

4 4

Re: [syslog-ng]program() destination
by John_Delisle＠ceridian.ca 08 Mar '01

08 Mar '01

Would you be able to provide an example of how one could use this to send mail? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 "amover(a)libero.it"<amo ver To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: [syslog-ng]program() destination balabit.hu 2001/03/08 02:18 AM Please respond to syslog-ng (I'm sending it again cause I'm not sure the first send was successful so sorry if it's a duplicate) About launching a program, specifically a perl script to do other jobs when some filters are matched the right code snippet is : #!/usr/bin/perl $fh = select (FOO); $| = 1; select ($fh); open FOO, ">>/foo.log" or die $!; while ( <STDIN> ) { print FOO $_; } close FOO; you need the first to line to disable buffering...(that's why you cannot say any lines in the file) Hope this could help the syslog-ng people :) Amodiovalerio Verde Computer freak and consultant amover(a)libero.it _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

error message
by jon＠dumbo.pobox.com 08 Mar '01

08 Mar '01

any ideas what this is? it goes away when i comment out the unix-stream line but..thats what the docs say to use for a linux-based distribution Mar 7 16:45:26 src@host/host syslog-ng[29264]: Error accepting AF_UNIX connection, opened connections: 100, max: 100 relevant info: Linux dolly1 2.4.0-test9 #12 Thu Dec 21 19:55:09 EST 2000 i686 unknown syslog-ng-1.4.11/ libol-0.2.21/ redhat options { create_dirs(yes); use_dns(no); sync(0); }; source src { unix-stream("/dev/log"); #############^^^^^^^^ internal(); udp(ip(0.0.0.0) port(514)); };

2 1

multiple destinations?
by jon＠dumbo.pobox.com 08 Mar '01

08 Mar '01

i would like to have syslog-ng log to two destinations...is that possible? ie... filter mail_filt { facility(mail) or facility(local4); }; destination maillogs { file("/var/log/ng/maillogs/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY.$HOUR" dir_perm(0755) perm(0644)); }; destination loghost { udp(host=x,port=y); # note, i know this is wrong...i will make it right when i actually do the config }; log { source(src); destination(maillogs); destination(loghost); filter(mail_filt); };

2 1

program() destination
by amover＠libero.it 08 Mar '01

08 Mar '01

(I'm sending it again cause I'm not sure the first send was successful so sorry if it's a duplicate) About launching a program, specifically a perl script to do other jobs when some filters are matched the right code snippet is : #!/usr/bin/perl $fh = select (FOO); $| = 1; select ($fh); open FOO, ">>/foo.log" or die $!; while ( <STDIN> ) { print FOO $_; } close FOO; you need the first to line to disable buffering...(that's why you cannot say any lines in the file) Hope this could help the syslog-ng people :) Amodiovalerio Verde Computer freak and consultant amover(a)libero.it

1 0

RE: [syslog-ng]multiple destinations?
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 08 Mar '01

08 Mar '01

Yes, this is possible. Regards, Drew > -----Original Message----- > From: jon(a)dumbo.pobox.com [SMTP:jon@dumbo.pobox.com] > Sent: Wednesday, March 07, 2001 10:04 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]multiple destinations? > > i would like to have syslog-ng log to two destinations...is that possible? > > ie... > filter mail_filt { facility(mail) or facility(local4); }; > > destination maillogs { > > file("/var/log/ng/maillogs/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY.$HOUR" > dir_perm(0755) perm(0644)); > }; > destination loghost { > udp(host=x,port=y); > # note, i know this is wrong...i will make it right when i > actually do the config > }; > > log { > source(src); > destination(maillogs); > destination(loghost); > filter(mail_filt); > }; > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

parser
by YAMAUCHI Tomohiro 07 Mar '01

07 Mar '01

Hi, I using 1.5.3. I wrote syslog-ng.conf. filter xconsole { level(debug..waning); }; I mistake warning <-> waning. In this case, syslog-ng output the following message. % syslog-ng Warning: Unknown priority level debug I want to output Warning: Unknown priority level waning or Warning: Unknown priority level debug..waning Is This difficult? -- YAMAUCHI Tomohiro handy(a)nid.co.jp

1 0