- syslog-ng - lists.balabit.hu

Need help.
by Simeon Johnston 06 Mar '01

06 Mar '01

I am sorry if this is in the doc's somewhere but I couldn't find it. I also could not find the archives for this list. How do I specify more than one priority? Actually a range of priorities. With syslog it is supposed to log that priority and above but I thought I read that it was different with syslog-ng. I seem to recal that you had to specify a range. I just can't remember where I read it. : ) BTW - solved the remote logging thing. It was the server side that was the problem. I changed the rule to accept everything instead of specifying a IP address and it works great now. Thanks everyone for all the help. sim

2 2

reg usage of syslog-ng
by Ramesh Kumar V 06 Mar '01

06 Mar '01

Hi, I have to port HP-UX code to linux. It uses "nettl" product for tracing and loging. Nettl is tool which provides loginf and tracing for an HPUX application. With this tool we can take logs and traces of a perticular Sub system in an application. We can filter loging with error level(like informative ,warning ,error etc). Can syslog-ng give similar functionalty. reg ramesh -- _/ _/_/_/_/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ _/ _/ _/ : Ramesh Kumar V _/_/_/_/ _/_/_/_/ : HP-ISO _/ _/ _/ : Ph: 2251554 Ext: 1273 _/ _/ _/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: [syslog-ng]Syslog-ng and Minilogd
by John_Delisle＠ceridian.ca 05 Mar '01

05 Mar '01

It could be killed by logrotate, check /etc/logrotate.d. It gzips logs, and restarts daemons. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 "Brian E. Seppanen" <seppy(a)chartermi.net> To: <syslog-ng(a)lists.balabit.hu> Sent by: cc: syslog-ng-admin@lists. Subject: [syslog-ng]Syslog-ng and Minilogd balabit.hu 2001/03/05 02:23 PM Please respond to syslog-ng Hello: I'm running syslog-ng on a redhat-7.0 box. I have a monitoring script that checks to insure that syslog-ng is running. The script greps the process listing for the pid listed in the pid file. If it's not found its not running, and its restarted. Now I'm not sure if my script is crap or whether I have another problem, because it seems that syslog-ng is getting restarted quite a bit. I'd say probably every other day. What I've noticed is that after syslog-ng restarts minilogd (which is I believe redhat specific)is also running and I believe there is contention for /dev/log. Minilogd apparently is used during the redhat boot process and logs stuff, before syslog starts and then hands off to syslog once it starts. This issue is occurring well after boot. Has anyone seen this issue as well? Below is my monitoring script. Perhaps there is an error there that is reporting a false positive? Anyone know of a better way to monitor a process to insure its running. snmptraps? ? I get no real indication of any sort of problem. Any insight appreciated. #!/usr/bin/perl -w use MIME::Entity; my $pid=`cat /var/run/syslog-ng.pid`; chomp $pid; my $check = `ps -eo pid,command| grep '$pid' | grep -v grep`; if ($check ne "") { #print "OK - check = $check"; exit 0; } else { my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time); $year %= 100; my $errortime = sprintf ("%02d:%02d:%02d-%02d/%02d/%02d",$hour,$min,$sec,$mon+1,$mday,$year); #print "NOT OK - check = $check"; system "/etc/rc.d/init.d/syslog-ng start"; $minilogd = `ps -eo pid,command | grep minilogd | grep -v grep`; $page = "Syslog Error at $errortime"; $top = MIME::Entity->build(Type =>"multipart/mixed", From =>"admin", To =>"pager\@localhost"); $top->attach(Data=>$page); $message="\n There is a problem with syslog-ng at $errortime, it's last known whereabouts were $pid. Syslog has been restarted. "; $top->attach(Data=>$message); open (MAIL, "| /usr/sbin/sendmail -t"); $top->print(\*MAIL); close MAIL; exit 0; } Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Syslog-ng and Minilogd
by Brian E. Seppanen 05 Mar '01

05 Mar '01

Hello: I'm running syslog-ng on a redhat-7.0 box. I have a monitoring script that checks to insure that syslog-ng is running. The script greps the process listing for the pid listed in the pid file. If it's not found its not running, and its restarted. Now I'm not sure if my script is crap or whether I have another problem, because it seems that syslog-ng is getting restarted quite a bit. I'd say probably every other day. What I've noticed is that after syslog-ng restarts minilogd (which is I believe redhat specific)is also running and I believe there is contention for /dev/log. Minilogd apparently is used during the redhat boot process and logs stuff, before syslog starts and then hands off to syslog once it starts. This issue is occurring well after boot. Has anyone seen this issue as well? Below is my monitoring script. Perhaps there is an error there that is reporting a false positive? Anyone know of a better way to monitor a process to insure its running. snmptraps? ? I get no real indication of any sort of problem. Any insight appreciated. #!/usr/bin/perl -w use MIME::Entity; my $pid=`cat /var/run/syslog-ng.pid`; chomp $pid; my $check = `ps -eo pid,command| grep '$pid' | grep -v grep`; if ($check ne "") { #print "OK - check = $check"; exit 0; } else { my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time); $year %= 100; my $errortime = sprintf("%02d:%02d:%02d-%02d/%02d/%02d",$hour,$min,$sec,$mon+1,$mday,$year); #print "NOT OK - check = $check"; system "/etc/rc.d/init.d/syslog-ng start"; $minilogd = `ps -eo pid,command | grep minilogd | grep -v grep`; $page = "Syslog Error at $errortime"; $top = MIME::Entity->build(Type =>"multipart/mixed", From =>"admin", To =>"pager\@localhost"); $top->attach(Data=>$page); $message="\n There is a problem with syslog-ng at $errortime, it's last known whereabouts were $pid. Syslog has been restarted. "; $top->attach(Data=>$message); open (MAIL, "| /usr/sbin/sendmail -t"); $top->print(\*MAIL); close MAIL; exit 0; } Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

1 0

match not match
by solarissparc 05 Mar '01

05 Mar '01

I have the following filter rules filter f_sonicwall { host("sonicwall") and (not match("*http*")); }; filter f_sonicwall-www { host("sonicwall") and match("*http*"); the sonicwall-www one works but the sonicwall just catches everything ignoring the not match statement i tried the following: filter f_sonicwall { host("sonicwall") and (not match("*http*")); }; filter f_sonicwall { host("sonicwall") and (not (match("*http*"))); }; filter f_sonicwall { host("sonicwall") and not match("*http*"); }; filter f_sonicwall { (host("sonicwall") and (not match("*http*"))); }; #filter f_kern { facility(kern) and not level(debug); }; Any ideas ?? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I am not the poet of goodness only....I do not decline to be the poet of wickedness also. -Walt Whitman ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

HP-UX logging solved (I think...)
by Stefan Nilsson 05 Mar '01

05 Mar '01

Hi, Finally I've managed to remove those strange extra lines from my logfiles: It turned out that /dev/log always gets 4096 bytes written to it, regardless of the length of the log entry - so I changed the MAX_LINE macro in read_line.h(libol) to 4096. I Also made a change to sources.c in the while (eol) loop in the function 'do_read_line'; after the call to do_handle_line I added the following lines: closure->pos = 0; return ST_OK | ST_GOON; This means that we will only log the first log-entry in the buffer, I think thats ok because the rest of the buffer seems to contain plain rubbish. Oh, I almost forgot; I'm using gcc on a HP-UX 11.00 system, libol 0.2.21, syslog-ng 1.4.4 Regards /stefan

2 1

filter syslog
by pierrick le fol 05 Mar '01

05 Mar '01

Hello, I seek a person who could help me in the filtering of event syslog. I wish filter the messages by address IP. If you have information or competences in this field, I am taking. Thank you for

2 2

no match() statement
by death die 02 Mar '01

02 Mar '01

For some reason for the sonicwall lines the "sonicwall" line doesn't seem to filter messages taht have proto=http even though I specify not match. source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal (); }; source network { udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514));}; destination messages { file("/var/adm/messages"); }; destination non-catch { file("/var/syslog/non-catch"); }; destination console { usertty("root"); }; destination auth { file("/var/log/authlog"); }; destination mail { file("/var/log/syslog"); }; destination debug { file("/var/log/debug"); }; destination console_all { usertty("*"); }; destination sonicwall { file("/var/syslog/sonicwall"); }; destination sonicwall-www { file("/var/syslog/sonicwall-www"); }; filter f_sonicwall { host("sonicwall") and not match("proto=http"); }; filter f_sonicwall-www { host("sonicwall") and match("proto=http"); }; filter f_auth { facility(auth); }; filter f_syslog { not facility( mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; log { source(network); filter(f_sonicwall-www); destination(sonicwall-www); }; log { source(network); filter(f_sonicwall); destination(sonicwall); }; log { source(local); filter(f_auth); destination(auth); }; log { source(local); filter(f_syslog); destination(messages); }; log { source(local); filter(f_daemon); destination(messages); }; log { source(local); filter(f_kern); destination(messages); }; log { source(local); filter(f_mail); destination(mail); }; log { source(network); filter(DEFAULT); destination(non-catch); _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

1 0

program() destination
by Maciek Pasternacki 01 Mar '01

01 Mar '01

Hello, I have following configuration on my machine: source logdev { unix-stream("/dev/log"); }; destination foo { program("/home/foo/.bin/loglogs.pl"); }; filter f_foo { not priority(debug) and not facility(mail); }; log { source(logdev); filter(f_foo); destination(foo); }; File /home/foo/.bin/loglogs.pl come as follows: #!/usr/bin/perl open FOO, ">/tmp/loglog.log"; while ( <STDIN> ) { print FOO $_; } close FOO; Could anybody tell why file /tmp/loglog.log stays empty no matter what I do? Greets, --Maciek -- __ Maciek Pasternacki <maciekp(a)japhy.fnord.org> [ http://japhy.fnord.org/ ] `| _ |_\ / *CENSORED* ( full version at http://japhy.fnord.org/sig.txt ) ,|{-}|}| }\/ \/ |____/

2 2

Re: [syslog-ng]program() destination
by John_Delisle＠ceridian.ca 01 Mar '01

01 Mar '01

I've found a way to send the message to an email address. It's a bit of a hack, but.. Basically you output your log to a file, and have a cron job that watches for that file, emails its contents, and deletes it. I'm using it to email a pager. 1- Configure your source line properly for the type of log you are catching 2 - Add a destination file rule 3 - Add a filter to filter for what you're looking for 4 - Add a log with above source, filter, and destination 5 - Install this script in /usr/bin or wherever 6 - Add a cron job such as the example that follows Sample syslog-ng.conf ------------------------------------------ options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); }; source s_remote { udp(ip(0.0.0.0) port(514)); }; destination d_powerpay { file("/var/log/powerpay"); }; destination d_powerpay_email { file("/var/log/powerpay_email"); }; filter f_emerg { level(emerg); }; filter f_powerpay { facility(local1); }; log { source(s_remote); filter(f_powerpay); destination(d_powerpay); }; log { source(s_remote); filter(f_powerpay); filter(f_emerg); destination(d_powerpay_email); }; log { source(s_remote); filter(DEFAULT); destination(d_mesg); }; ------------------------------------- Sample cron entry ------------------------------------ 5,10,15,20,25,30,35,40,45,50,55,0 * * * * /usr/bin/mail_log.sh /var/log/powerpay_email inet_admin(a)ceridian.ca ----------------------------------- mail_log.sh script ----------------------------------- #!/bin/bash # # mail_log.sh # by John Delisle john_delisle(a)ceridian.ca # Feb 28 2001 # # # If a file $1 exists, it mails its contents to $2, and deletes $1 # # MAILPROG="/usr/sbin/mail" if [ $# != 2 ]; then echo "Usage: $0 file_to_check email_address" exit 1; fi if [ ! -e $1 ]; then #echo "$1 not found, exiting" exit 2; else $MAILPROG $2 < $1 echo "Message Sent to $2"; echo "Removing $2"; rm $2 fi exit 0; ----------------------------------- John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 John_Delisle@ceridian. ca To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: Re: [syslog-ng]program() destination balabit.hu 2001/02/28 01:59 PM Please respond to syslog-ng Maciek, have you had any success sending email using this method? I'm trying to get syslog-ng to send an email when a certain alert comes in. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Maciek Pasternacki <maciekp(a)japhy.fnord.o To: syslog-ng(a)lists.balabit.hu rg> cc: Sent by: Subject: [syslog-ng]program() destination syslog-ng-admin@lists. balabit.hu 2001/02/28 12:43 PM Please respond to syslog-ng Hello, I have following configuration on my machine: source logdev { unix-stream("/dev/log"); }; destination foo { program("/home/foo/.bin/loglogs.pl"); }; filter f_foo { not priority(debug) and not facility(mail); }; log { source(logdev); filter(f_foo); destination(foo); }; File /home/foo/.bin/loglogs.pl come as follows: #!/usr/bin/perl open FOO, ">/tmp/loglog.log"; while ( <STDIN> ) { print FOO $_; } close FOO; Could anybody tell why file /tmp/loglog.log stays empty no matter what I do? Greets, --Maciek -- __ Maciek Pasternacki <maciekp(a)japhy.fnord.org> [ http://japhy.fnord.org/ ] `| _ |_\ / *CENSORED* ( full version at http://japhy.fnord.org/sig.txt ) ,|{-}|}| }\/ \/ |____/ (See attached file: atty1o2p.dat) (See attached file: atty1o2p.dat)

2 1

Re: [syslog-ng]program() destination
by John_Delisle＠ceridian.ca 01 Mar '01

01 Mar '01

Maciek, have you had any success sending email using this method? I'm trying to get syslog-ng to send an email when a certain alert comes in. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Maciek Pasternacki <maciekp(a)japhy.fnord.o To: syslog-ng(a)lists.balabit.hu rg> cc: Sent by: Subject: [syslog-ng]program() destination syslog-ng-admin@lists. balabit.hu 2001/02/28 12:43 PM Please respond to syslog-ng Hello, I have following configuration on my machine: source logdev { unix-stream("/dev/log"); }; destination foo { program("/home/foo/.bin/loglogs.pl"); }; filter f_foo { not priority(debug) and not facility(mail); }; log { source(logdev); filter(f_foo); destination(foo); }; File /home/foo/.bin/loglogs.pl come as follows: #!/usr/bin/perl open FOO, ">/tmp/loglog.log"; while ( <STDIN> ) { print FOO $_; } close FOO; Could anybody tell why file /tmp/loglog.log stays empty no matter what I do? Greets, --Maciek -- __ Maciek Pasternacki <maciekp(a)japhy.fnord.org> [ http://japhy.fnord.org/ ] `| _ |_\ / *CENSORED* ( full version at http://japhy.fnord.org/sig.txt ) ,|{-}|}| }\/ \/ |____/ (See attached file: atty1o2p.dat)

2 1

Re: [syslog-ng]program() destination
by John_Delisle＠ceridian.ca 28 Feb '01

28 Feb '01

I've updated the script, looks like after deleting the file syslog-ng doesn't recreate. Here is the modified code. #!/bin/bash # # mail_log.sh # by John Delisle john_delisle(a)ceridian.ca # Feb 28 2001 # # # If a file $1 exists, it mails its contents to $2, and deletes $1 # # MAILPROG="/usr/sbin/mail" FACSEV="user.info" if [ $# != 2 ]; then echo "Usage: $0 file_to_check email_address" exit 1; fi if [ ! -s $1 ]; then #echo "$1 not found or size not greater than 0, exiting" exit 2; else $MAILPROG $2 < $1 echo "Message Sent to $2"; logger -p $FACSEV "Message from $1 sent to $2" echo "Removing $1"; > $1 fi exit 0; John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 John_Delisle@ceridian. ca To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: Re: [syslog-ng]program() destination balabit.hu 2001/02/28 04:27 PM Please respond to syslog-ng I've found a way to send the message to an email address. It's a bit of a hack, but.. Basically you output your log to a file, and have a cron job that watches for that file, emails its contents, and deletes it. I'm using it to email a pager. 1- Configure your source line properly for the type of log you are catching 2 - Add a destination file rule 3 - Add a filter to filter for what you're looking for 4 - Add a log with above source, filter, and destination 5 - Install this script in /usr/bin or wherever 6 - Add a cron job such as the example that follows Sample syslog-ng.conf ------------------------------------------ options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); }; source s_remote { udp(ip(0.0.0.0) port(514)); }; destination d_powerpay { file("/var/log/powerpay"); }; destination d_powerpay_email { file("/var/log/powerpay_email"); }; filter f_emerg { level(emerg); }; filter f_powerpay { facility(local1); }; log { source(s_remote); filter(f_powerpay); destination(d_powerpay); }; log { source(s_remote); filter(f_powerpay); filter(f_emerg); destination(d_powerpay_email); }; log { source(s_remote); filter(DEFAULT); destination(d_mesg); }; ------------------------------------- Sample cron entry ------------------------------------ 5,10,15,20,25,30,35,40,45,50,55,0 * * * * /usr/bin/mail_log.sh /var/log/powerpay_email inet_admin(a)ceridian.ca ----------------------------------- mail_log.sh script ----------------------------------- #!/bin/bash # # mail_log.sh # by John Delisle john_delisle(a)ceridian.ca # Feb 28 2001 # # # If a file $1 exists, it mails its contents to $2, and deletes $1 # # MAILPROG="/usr/sbin/mail" if [ $# != 2 ]; then echo "Usage: $0 file_to_check email_address" exit 1; fi if [ ! -e $1 ]; then #echo "$1 not found, exiting" exit 2; else $MAILPROG $2 < $1 echo "Message Sent to $2"; echo "Removing $2"; rm $2 fi exit 0; ----------------------------------- John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 John_Delisle@ceridian. ca To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: Re: [syslog-ng]program() destination balabit.hu 2001/02/28 01:59 PM Please respond to syslog-ng Maciek, have you had any success sending email using this method? I'm trying to get syslog-ng to send an email when a certain alert comes in. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Maciek Pasternacki <maciekp(a)japhy.fnord.o To: syslog-ng(a)lists.balabit.hu rg> cc: Sent by: Subject: [syslog-ng]program() destination syslog-ng-admin@lists. balabit.hu 2001/02/28 12:43 PM Please respond to syslog-ng Hello, I have following configuration on my machine: source logdev { unix-stream("/dev/log"); }; destination foo { program("/home/foo/.bin/loglogs.pl"); }; filter f_foo { not priority(debug) and not facility(mail); }; log { source(logdev); filter(f_foo); destination(foo); }; File /home/foo/.bin/loglogs.pl come as follows: #!/usr/bin/perl open FOO, ">/tmp/loglog.log"; while ( <STDIN> ) { print FOO $_; } close FOO; Could anybody tell why file /tmp/loglog.log stays empty no matter what I do? Greets, --Maciek -- __ Maciek Pasternacki <maciekp(a)japhy.fnord.org> [ http://japhy.fnord.org/ ] `| _ |_\ / *CENSORED* ( full version at http://japhy.fnord.org/sig.txt ) ,|{-}|}| }\/ \/ |____/ (See attached file: atty1o2p.dat) (See attached file: atty1o2p.dat) (See attached file: atty1o2p.dat)

1 0

Re: [syslog-ng]AIX compatability issue?
by John_Delisle＠ceridian.ca 28 Feb '01

28 Feb '01

I've discovered the problem. It seems AIX sends a 'verbose' string by default. If you add a -s to the line where you call AIXs syslogd from it sends a more typical message. After this change all my AIX messages are filtered correctly. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 John_Delisle@ceridian. ca To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: Re: [syslog-ng]AIX compatability issue? balabit.hu 2001/02/23 04:46 PM Please respond to syslog-ng Would it be easier to replace the AIX syslogd with syslog-ng? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Brad Arlt <arlt(a)cpsc.ucalgary.ca To: syslog-ng(a)lists.balabit.hu > cc: Sent by: Subject: Re: [syslog-ng]AIX compatability issue? syslog-ng-admin@lists. balabit.hu 2001/02/23 04:06 PM Please respond to syslog-ng On Fri, Feb 23, 2001 at 01:11:30PM -0600, John_Delisle(a)ceridian.ca wrote: > > Thanks for the response. Sorry to sound ignorant, but what do you mean by > truss or a strace? Is that a type of bracket? Below is the output I get strace and truss log to stderror (or a file) all the system call a process makes. I took a look at the AIX box we have kicking around and the only strace on it is for tracing STREAMS. This is not what you want. I looked at the strace homepage, and as far as I can tell, AIX is *not* one of the supported platforms. AIX seems to have a tracing utility called trace(1). It looks kinda odd, but should do the job. ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_) \(_) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Trying to send log over network
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 28 Feb '01

28 Feb '01

Sim, I have just a couple of other questions. What is the address of your loghost and the address of the clients? I'm looking at your two configs and I want to make sure that the destination for the problem machine is ok. Do you have a 192.168.1.19 host on your network and is it listening for tcp connections on port 514? In the loghost config you reference a source of 192.168.1.1 which tells me that your loghost is 192.168.1.1. If you are trying to establish a connection to a host using the tcp/ip you also need to make sure that the host is listening for tcp/ip connections. The loghost config is listening for tcp/ip on 192.168.1.1 port 10001 and you are trying to make a tcp connection with 192.168.1.19 on port 514. Is this what you are intending, if so this won't work. Change your destination in your client to read destination d_bg {tcp("192.168.1.1:10001") }; That should at least let you log to that loghost. Regards, Drew > -----Original Message----- > From: Simeon Johnston [SMTP:simeonuj@eetc.com] > Sent: Wednesday, February 21, 2001 5:39 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Trying to send log over network > > Here are the configs. > > I have added as an attachment the strace output files using "strace -f -ff > -o > localfile syslog-ng". > > This is the config for the problem conputers. > > options { sync (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames (on); > use_dns (no); > use_fqdn (no); > create_dirs (yes); > keep_hostname (yes); > }; > > source s_sys { unix-stream ("/dev/log"); internal(); }; > > destination d_cons { file("/var/log/ng/kern.log"); }; > destination d_mesg { file("/var/log/ng/messages"); }; > destination d_auth { file("/var/log/ng/secure"); }; > destination d_mail { file("/var/log/ng/maillog"); }; > destination d_spol { file("/var/log/ng/spooler"); }; > destination d_boot { file("/var/log/ng/boot.log"); }; > destination d_mlal { file("/var/log/ng/emerg.log"); }; > destination d_bg { tcp("192.168.1.19:514"); }; > destination d_sshd { file("/var/log/ng/sshd.log"); }; > > filter f_filter1 { facility(kern); }; > filter f_filter2 { level(info); }; > filter f_filter3 { facility(authpriv); }; > filter f_filter4 { facility(mail); }; > filter f_filter5 { level(emerg); }; > filter f_filter6 { facility(uucp) or > (facility(news) and level(crit)); }; > filter f_tcplog { level(debug); }; > filter f_sshd { match("sshd"); }; > > log { source(s_sys); filter(f_filter1); destination(d_cons); }; > log { source(s_sys); filter(f_filter2); destination(d_mesg); }; > log { source(s_sys); filter(f_filter3); destination(d_auth); }; > log { source(s_sys); filter(f_filter4); destination(d_mail); }; > log { source(s_sys); filter(f_filter5); destination(d_mlal); }; > log { source(s_sys); filter(f_filter6); destination(d_spol); }; > log { source(s_sys); filter(f_tcplog); destination(d_bg); }; > log { source(s_sys); filter(f_sshd); destination(d_sshd); }; > > > This is the logserver config > > options { sync (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames (on); > use_dns (no); > use_fqdn (no); > create_dirs (yes); > keep_hostname (yes); > }; > > source s_sys { unix-stream ("/dev/log"); internal(); }; > source s_tcp { tcp (ip(192.168.1.1) port(10001)); }; > > destination d_cons { file("/var/log/ng/kernel"); }; > destination d_mesg { file("/var/log/ng/messages"); }; > destination d_auth { file("/var/log/ng/secure"); }; > destination d_mail { file("/var/log/ng/maillog"); }; > destination d_spol { file("/var/log/ng/spooler"); }; > destination d_boot { file("/var/log/ng/boot.log"); }; > destination d_mlal { file("/var/log/ng/emerg.log"); }; > destination d_pptp { file("/var/log/ng/pptpd.log"); }; > destination d_daemon { file("/var/log/ng/daemon.log"); }; > destination d_firewall { file("/var/log/ng/firewall.log"); }; > > filter f_filter1 { facility(kern); }; > filter f_filter2 { level(info) and not facility(mail,authpriv,kern); > }; > filter f_filter3 { facility(authpriv); }; > filter f_filter4 { facility(mail); }; > filter f_filter5 { level(emerg); }; > filter f_filter6 { facility(uucp); }; > filter f_pptpd { match("pptpd"); }; > filter f_daemon { facility(daemon); }; > filter f_boot { facility(local7); }; > filter f_firewall { level(debug); }; > > log { source(s_sys); filter(f_filter1); destination(d_cons); }; > log { source(s_sys); filter(f_filter2); destination(d_mesg); }; > log { source(s_sys); filter(f_filter3); destination(d_auth); }; > log { source(s_sys); filter(f_filter4); destination(d_mail); }; > log { source(s_sys); filter(f_filter5); destination(d_mlal); }; > log { source(s_sys); filter(f_filter6); destination(d_spol); }; > log { source(s_sys); filter(f_pptpd); destination(d_pptp); }; > log { source(s_sys); filter(f_daemon); destination(d_daemon); }; > log { source(s_sys); filter(f_boot); destination(d_boot); }; > log { source(s_tcp); filter(f_firewall); destination(d_firewall); }; > > Thank you for your help. > > sim > > "Hamilton, Andrew Mr RAYTHEON 5 SIG CMD" wrote: > > > 1. No syslog-ng runs as its own daemon. Works much better this way. > > 2. If the answer to 1 was yes it would make a difference. But since it > > isn't then no. > > 3. Could you post a sample of your config file? That might be helpful. > > Also could you post part of your strace results? That would at least > give > > us info on where to look for your problem. > > > > Random thoughts...do you have some sort of port monitor that could be > > blocking your default ports? I have seen that before. > > > > Regards. > > Drew << File: strace.syslog-ng >> << File: strace.syslog-ng.25136 >>

3 3

Newbie intro/question
by Dave Carmean 28 Feb '01

28 Feb '01

Greetings from a list newbie. I discovered syslog-ng the other day while STFW for more info about logsurfer, which I've been trying out recently. I've looked at the list archives for several months back, but don't see obvious answers to the following: - Are people using -ng to perform noise filtering and/or alerting a-la Swatch, WOTS, logsurfer, etc? Or is most filtering just to effectively increase the number of facilities by sorting on reporting program name? - Has anybody devised a way with -ng to monitor the repeat rate of a particular message? I.e. if you get 10 log_info messages per hour from named on host foo, ignore them, but if you get 100, save them and trigger some event? - I would like to embed the message's facility/level into the recorded message text, similar to what SGI's Irix' syslogd does, although probably in human-readable form rather than an octal number. Maybe I'm looking in the wrong docs, but I'd like to write something like this to the output channel: "Feb 27 01:31:05 foo sendmail[nnn]: ${FACILITY}/${PRIORITY} \ $rest_of_message" I'll go RTFM some more, but if anybody can give some basic answers, I'd be grateful. Thanks. -- Dave Live fast. Die young. Leave a good-looking audit trail.

1 0

Re: [syslog-ng]Mailing alerts
by John_Delisle＠ceridian.ca 27 Feb '01

27 Feb '01

Just had a thought, would a better way be to have two destinations, a file (say /tmp/tmp_alert) and a program destination that mails a user that file? Is there any way to overwrite a file when using a file destination so there are no stale entries in it? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 John_Delisle@ceridian. ca To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: [syslog-ng]Mailing alerts balabit.hu 2001/02/27 04:07 PM Please respond to syslog-ng Has anyone had any success getting syslog-ng to send an alert via email? I'd guess you use the program destination, but I'm unsure how to call it etc. Any ideas? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Mailing alerts
by John_Delisle＠ceridian.ca 27 Feb '01

27 Feb '01

Has anyone had any success getting syslog-ng to send an alert via email? I'd guess you use the program destination, but I'm unsure how to call it etc. Any ideas? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909

1 0

(OT) routers and host matching
by Brian E. Seppanen 27 Feb '01

27 Feb '01

Hi: Sort of off topic, but someone here might be more familiar with this situation. I monitor several routers with syslog-ng on a central host. One problem I'm facing is that I want to redirect logs dependent upon the router to different files. This works well, but I have one problem. We do not use DNS to resolve names, and we match upon host IP's. The problem is that the routers have several possible IP's and I'm finding that more and more often that I don't have a filter defined for certain IP's. My syslog-ng config is already a god awful mess and I'm hoping that I'm being short sighted and that there is a solution to my quandry. Is it possible to have the router log via one interface and therefore guarantee a host IP match? Has anyone found a way to work around this? I'd really appreciate any insight. thanks, Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

2 1

syslog-ng-1.4.11 compile error
by Tony Reed 26 Feb '01

26 Feb '01

Hi: What is yywrap part of? This happens: cfg-lex.o: In function `yylex': cfg-lex.o(.text+0x45e): undefined reference to `yywrap' cfg-lex.o: In function `input': cfg-lex.o(.text+0x9b8): undefined reference to `yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/STUFF/syslog-ng-1.4.11/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/STUFF/syslog-ng-1.4.11/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/STUFF/syslog-ng-1.4.11/src' make: *** [all-recursive] Error 1 AS far as I know, I have a working flex and flex++. This looks like an interesting project, I'd like to be able to compile it. Thanks. -- Tony Reed <trljc(a)altern.org>

1 0

syslog-ng 1.4.11 and libol 0.2.21 released
by Balazs Scheidler 25 Feb '01

25 Feb '01

Hi, We have released syslog-ng 1.4.11 and the corresponding libol 0.2.21 fixing the long-standing SIGHUP problem which caused crashes upon receipt of the HUP signal. It is available at the usual location: http://www.balabit.hu/en/products/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Re: [syslog-ng]AIX compatability issue?
by John_Delisle＠ceridian.ca 23 Feb '01

23 Feb '01

Would it be easier to replace the AIX syslogd with syslog-ng? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Brad Arlt <arlt(a)cpsc.ucalgary.ca To: syslog-ng(a)lists.balabit.hu > cc: Sent by: Subject: Re: [syslog-ng]AIX compatability issue? syslog-ng-admin@lists. balabit.hu 2001/02/23 04:06 PM Please respond to syslog-ng On Fri, Feb 23, 2001 at 01:11:30PM -0600, John_Delisle(a)ceridian.ca wrote: > > Thanks for the response. Sorry to sound ignorant, but what do you mean by > truss or a strace? Is that a type of bracket? Below is the output I get strace and truss log to stderror (or a file) all the system call a process makes. I took a look at the AIX box we have kicking around and the only strace on it is for tracing STREAMS. This is not what you want. I looked at the strace homepage, and as far as I can tell, AIX is *not* one of the supported platforms. AIX seems to have a tracing utility called trace(1). It looks kinda odd, but should do the job. ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_) \(_) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]AIX compatability issue?
by John_Delisle＠ceridian.ca 23 Feb '01

23 Feb '01

Thanks for the response. Sorry to sound ignorant, but what do you mean by truss or a strace? Is that a type of bracket? Below is the output I get to /var/log/messages: Feb 21 21:41:25 Message forwarded from ppsvrwasprd2: pskavins: testing using local1.notice John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Balazs Scheidler <bazsi(a)balabit.hu> To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: Re: [syslog-ng]AIX compatability issue? balabit.hu 2001/02/23 05:34 AM Please respond to syslog-ng Hi, > I'm running a central syslog-ng server with the following syslog-ng.conf: > > options { sync (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames (off); > use_dns (yes); > use_fqdn (no); > create_dirs (no); > keep_hostname (yes); > }; > > source s_sys { unix-stream ("/dev/log"); internal(); }; > source s_remote { udp(ip(0.0.0.0) port(514)); }; > > destination d_mesg { file("/var/log/messages"); }; > destination d_powerpay { file("/var/log/powerpay"); }; > > filter f_powerpay { facility(local1); }; > > log { source(s_sys); destination(d_mesg); }; > log { source(s_remote); filter(f_powerpay); destination(d_powerpay); }; > log { source(s_remote); destination(d_mesg); }; > > > I have serveral AIX servers that don't seem to get logged. I'm sending > messages with facility set to local1. If I comment out the second log line > above I get messages from the AIX servers to my messages file. When I > enable the second log line as it is above I get nothing. I've tested > sending messages from other platforms with facility set to local1 and they > get logged in the correct file as expected. /var/log/messages should get a copy of each message regardless of the second logline. you should check whether syslog-ng receives the lines correctly with a truss or an strace. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

sync within tcp
by matthew.copeland＠honeywell.com 23 Feb '01

23 Feb '01

I am using the following for my config file. I have been told that you can sync a tcp connection to a certain number of lines, and I thought this was how you do it, but it dies on the first line that has the sync with a parse error. If I move it to its own line, outside of the tcp, it dies parsing there. Can someone please tell me where I am messing up here? Thanks, Matthew M. Copeland options { long_hostnames(off); log_fifo_size(1440000); }; source src { unix-stream("/dev/log"); internal(); }; destination normal_messages { tcp("129.235.66.4" port(999) sync(10)); }; destination immediate_messages { tcp("129.235.66.4" port(999) sync(0)); }; filter f_gs_alert { match("GS_ALERT"); }; log { source (src); filter(f_gs_alert); destination(immediate_messages); }; log { source(src); filter(DEFAULT); destination(normal_messages); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 4

HUP causes a core dump
by Chris Pile 23 Feb '01

23 Feb '01

Balazs Scheidler, I read your message from: http://lists.balabit.hu/pipermail/syslog-ng/2001-January/001147.html and noticed you required a backtrace to help debug the problem where sending SIGHUP to syslog-ng causes a core dump. We have noticed this problem occurs when you send repeated SIGHUP signals within about a second of each other. This can happen either manually or when newsyslog is run and HUPs syslog-ng while it rotates/gzips the logs. (newsyslog -v) quick example of how to core syslog-ng manually: $ ps aux | grep syslog-ng root 14416 0.2 1.0 928 624 ?? Ss 5:07PM 0:00.06 /usr/local/sbin/syslog-ng -p /var/run/syslog.pid $ kill -HUP 14416 $ kill -HUP 14416 bash: kill: (14416) - No such pid $ cat /var/run/syslog.pid 14416 $ ps aux | grep syslog-ng <nothing, process cored> OS: FreeBSD 3.3-RELEASE syslog-ng: 1.4.10 Thanks, Chris Pile -- See below the gdb output: $ gdb syslog-ng -c syslog-ng.core (gdb) bt #0 0x280aa3d0 in kill () from /usr/lib/libc.so.3 #1 0x280de728 in abort () from /usr/lib/libc.so.3 #2 0x8057727 in fatal (format=0x805d2db "Memory corrupted!\n") at werror.c:187 #3 0x8057fa0 in debug_free (m=0x8061a28) at xalloc.c:95 #4 0x805839d in ol_space_free (p=0x8061a2c) at xalloc.c:315 #5 0x80585ae in do_flush (c=0x8071388, w=0xbfbfdaa8) at pkt_buffer.c:101 #6 0x8055fee in write_callback (fd=0x8071408) at io.c:487 #7 0x8055a43 in io_iter (b=0x8062008) at io.c:253 #8 0x8049a58 in main_loop (backend=0x8062008) at main.c:148 #9 0x8049f8f in main (argc=5, argv=0xbfbfdc04) at main.c:317 #10 0x80496b9 in _start () (gdb) bt full #0 0x280aa3d0 in kill () from /usr/lib/libc.so.3 No symbol table info available. #1 0x280de728 in abort () from /usr/lib/libc.so.3 No symbol table info available. #2 0x8057727 in fatal (format=0x805d2db "Memory corrupted!\n") at werror.c:187 args = 0xbfbfda28 "¼^\005\b\004" #3 0x8057fa0 in debug_free (m=0x8061a28) at xalloc.c:95 p = (int *) 0x8061a28 real_size = 16 size = 4 #4 0x805839d in ol_space_free (p=0x8061a2c) at xalloc.c:315 m = (int *) 0x8061a28 #5 0x80585ae in do_flush (c=0x8071388, w=0xbfbfdaa8) at pkt_buffer.c:101 self = (struct pkt_buffer *) 0x8071388 res = 87 item_this = (struct ol_queue_node *) 0x8061a2c item_next = (struct ol_queue_node *) 0x80713b4 item = (struct buffer_node *) 0x8061a2c #6 0x8055fee in write_callback (fd=0x8071408) at io.c:487 self = (struct io_fd *) 0x8071408 res = 134577764 w = {super = {super = {next = 0x0, isa = 0x0, alloc_method = 2 '\002', marked = 0 '\000', dead = 0 '\000'}, write = 0x8055ebc <do_write>, writestr = 0}, fd = 0} #7 0x8055a43 in io_iter (b=0x8062008) at io.c:253 fd = (struct nonblocking_fd *) 0x8071408 i = 0 nfds = 2 nco = 3217021744 fds = (struct pollfd *) 0xbfbfdad4 res = 1 timeout = 0 now = 982946899 #8 0x8049a58 in main_loop (backend=0x8062008) at main.c:148 exit_main_loop = 0 #9 0x8049f8f in main (argc=5, argv=0xbfbfdc04) at main.c:317 do_fork = 1 opt = -1 backend = (struct syslog_backend *) 0x8062008 syslog_ng_options = {{name = 0x8058cc0 "cfgfile", has_arg = 1, flag = 0x0, val = 102}, {name = 0x8058cc8 "pidfile", has_arg = 1, flag = 0x0, val = 112}, {name = 0x8058cd0 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x8058cd6 "verbose", has_arg = 0, flag = 0x0, val = 118}, {name = 0x8058cde "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x8058ce3 "version", has_arg = 0, flag = 0x0, val = 86}, {name = 0x8058ceb "yydebug", has_arg = 0, flag = 0x0, val = 121}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}} #10 0x80496b9 in _start () No symbol table info available.

1 0

Re: [syslog-ng] use_fqdn()
by Gabor Kiss 23 Feb '01

23 Feb '01

> > options { use_fqdn(yes); }; > > > > I've tried different options and all numerical ones are excepted ok. > > Options with accepted values described as 'yes' or 'no' in the > > documentation cause the deamon to fail on start-up. > > > > Have I got the syntax wrong? > > Do I need a newer version to enable this feature? > > If so, Is there a different option that will give me the full domain name > > in this version? > > This option is supported only 1.3.x and later. I think you should install > 1.3.15, I intent to release it as a stable version soon. I have 1.4.0rc3 and I cannot configure FQDNs. Current options are: options { long_hostnames(on); chain_hostnames(yes); use_fqdn(yes); sync(0); }; What did I wrong? Gabor

1 0