- syslog-ng - lists.balabit.hu

Garbage Collection
by Brian E. Seppanen 08 Jan '01

08 Jan '01

I'm trying to determine the optimal setting for garbage collection. I'm running a box that is logging info from other hosts, and my previous settings appeared to run too frequently and drop messages. I started syslog-ng with the verbose argument, and my objects were approximately 316 so I set it close to that. However, this number of objects seems to increase. At first garbage collection was running at least twice a minute and that was using the suggestion of close to the minimal number of allocated objects. I've doubled the idle threshhold to twice my number of objects and it seems to run every 5 minutes now. What is the risk of the garbage collector not running frequently enough? Does anyone have any tweaks they've found helpful? TIA Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

1 0

Garbage characters in syslog.log on HP-UX
by Mike Scheidler 05 Jan '01

05 Jan '01

I'm seeing stuff like this in my syslog file: Jan 5 15:35:14 kopt0308 syslog: su : + 2 c23mts-root Jan 5 15:35:14 kopt0308 { Jan 5 15:35:14 kopt0308 L{ Jan 5 15:35:14 kopt0308 L^TC Jan 5 15:35:14 kopt0308 { Jan 5 15:35:14 kopt0308 L{ [...] Jan 5 16:00:57 kopt0308 ^L^GK<38>Jan 5 16:00:57 DTSESSION: pamauthenticate status=0 Jan 5 16:00:58 kopt0308 XL<38>Jan 5 16:00:57 DTSESSION: pam_acct_status status=0 I'm new to syslog-ng, but have read through the mail archives, so I know that this is not a new problem for folks on HP-UX systems. I didn't find a definitive solution, though. Is this really something that has no known fix or workaround? P.S. No, I'm not related to Balazs, unless it's very remotely. -- Mike Scheidler c23mts(a)eng.delcoelect.com Unix System Administration (KAT Team) Delphi Delco Electronics Systems Kokomo, IN 46904-9005

1 0

Unaligned Access
by Michael Senn 05 Jan '01

05 Jan '01

I have just compiled the source code on Tru64. When I go to run the binary a message displays as follows: Unaligned access pid=63911 <syslog-ng> va=0x1400133dc pc=0x12001c1d0 ra=0x12001c 1b8 inst=0xb4200010 Unaligned access pid=63911 <syslog-ng> va=0x1400133d4 pc=0x120017bc4 ra=0x12001c 1e0 inst=0xb6110008 Unaligned access pid=63911 <syslog-ng> va=0x1400133cc pc=0x120017bc8 ra=0x12001c 1e0 inst=0xb4510000 Unaligned access pid=63911 <syslog-ng> va=0x1400133cc pc=0x120017bd0 ra=0x12001c 1e0 inst=0xa4510000 Has anyone else tried to compile and run on this platform and if so how did you fix the above. Michael

1 0

Multiple configuration files.
by Scott A. McIntyre 05 Jan '01

05 Jan '01

Hi, I'm looking in to using syslog-ng as a syslog-sink for a number of nodes, but am concerned that the configuration file may become somewhat cluttered and unwieldy. Is there any way to have syslog-ng read it's configuration information in the increasingly popular "everything in this directory is a configuration file to be read" manner? The examples I'm thinking of include xinetd and logrotate... It would be useful to have all of the host-specific filters, destinations and sources all in one file, but only for that host in question, rather than having to build what could eventually be a very large single file. Thanks. Scott

2 2

Filter on severity range
by Jon Marks 29 Dec '00

29 Dec '00

Hello, I'm very sorry if this is answered somewhere else, or if the answer is so obvious that it's a waste of time :) I can't see anything in the documentation which explicitly addresses this. I have a question about filtering on ranges of severities. A filter such as filter f_daemon { facility(daemon) and level(info); }; catches messages logged to the daemon facility at severity info. It differs from the traditional behavior of syslogd in that it doesn't catch severities beyond info, however. Is there a shorthand way to specify a range of priorities (i.e. to achieve behavior similar to the traditional syslogd)? Or, is it necessary to write a filter such as the following one? filter f_info { level(info) or level(notice) or .. or level(emerg); }; filter f_daemon { facility(daemon) and filter(f_info); }; Thank you very much. -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign

3 3

Matching hostnames problem
by Keith McDuffee 28 Dec '00

28 Dec '00

One problem I've found after installing syslog-ng 1.4.10 on a Solaris 2.6 system is with repeating messages, especially those originating from remote hosts. For example, here's some lines from my config file: ---- source s_udp { udp(); }; destination d_udp { file("/var/log/remote/$HOST.$FACILITY"); }; filter f_udp { level(notice) or (facility(local0) and level(info)) or (facility(local1) and level(info)) or (facility(local2) and level(info)); }; log ( source(s_udp); filter(f_udp); destination(d_udp); }; ---- Using this configuration, I get files in /var/log/remote that look like this: hostname1.local0 hostname2.local2 hostname1.auth last.local2 See that "last.local2"? Well, "last" is not a host -- it's taking it from the log message and mistakenly turning it into a hostname. Here's a line from "last.local2": --- Dec 22 10:14:13 last message repeated 2 times --- Any idea at all how to fix that besides making a filter for any hosts named "last"? Thanks, Keith

1 0

Re: syslog-ng encryption
by Balazs Scheidler 27 Dec '00

27 Dec '00

> Hello. I have been running syslog-ng for some now and I am quiet pleased. I > am writing to ask about the encryption algorithm in syslog-ng. Not only > about how it is implemented (I can't read Hungarian and neither can > babelfish), but also if or when it will become part of the distribution. I > could not find information in the mailing lists archives. thank you for your > time. I'm currently very busy developing Zorp (it's a proxy firewall suite at http://www.balabit.hu/products/zorp/) so I don't have too much time to spend on syslog-ng. I only write bugfixes, and merge in patches sent by others. So there's no development schedule, and I can't say anything for sure. I'd like to add SSL support to syslog-ng, but I don't know when. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: syslogng
by Balazs Scheidler 27 Dec '00

27 Dec '00

On Fri, Oct 20, 2000 at 04:33:31PM -0400, Keith Meyers wrote: > Balazs, > > I was wondering if there is a way to introduce new "Facilities" into > syslog-ng. Do i have to modify the source code, or can it be done > through the config file. In the end, I am trying to allow logging to > individual files on a per process basis.... > > Any suggestions or comments greatly appreciated... Syslog-ng can filter on facilities specified by number, for example: filter f_numfac { facility(16); }; This is the same as facility(local0), but the number can be anything. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Bug in syslog-ng 1.4.10 ?
by Keith McDuffee 22 Dec '00

22 Dec '00

One problem I've found after installing syslog-ng 1.4.10 on a Solaris 2.6 system is with repeating messages. For example, here's some lines from my config file: ---- source s_udp { udp(); }; destination d_udp { file("/var/log/remote/$HOST.$FACILITY"); }; filter f_udp { level(notice) or (facility(local0) and level(info)) or (facility(local1) and level(info)) or (facility(local2) and level(info)); }; log ( source(s_udp); filter(f_udp); destination(d_udp); }; ---- Using this configuration, I get files in /var/log/remote that look like this: hostname1.local0 hostname2.local2 hostname1.auth last.local2 See that "last.local2"? Well, "last" is not a host -- it's taking it from the log message and mistakenly turning it into a hostname. Here's a line from "last.local2": --- Dec 22 10:14:13 last message repeated 2 times --- Any idea at all how to fix that? Thanks, Keith

1 0

syslog-ng and sendmail
by Serge van Thillo 20 Dec '00

20 Dec '00

Hi people. I compiled syslog-ng today and tried out some things. It works quite ok, there only a few things I am missing. When I log facility mail I only see to adressen. this is the same when I log everything to one file. so for example: Dec 20 02:27:34 linux sendmail[10439]: eBK1RX410437: to=<serge(a)mydomain.nl>, delay=00:00:00, xdelay=00:00:00, mailer=cyrus, pri=38193, dsn=2.0.0, stat=Sent Only the line telling me who send the message is missing. I will include the config file. Can anyone tell me what is wrong? Thanks in advance. Greets, Serge. --------------------------------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); }; destination console { file("/dev/console"); }; destination messages { file("/var/log/messages"); }; destination secure { file("/var/log/secure"); }; destination maillog { file("/var/log/maillog"); }; destination spooler { file("/var/log/spooler"); }; destination boot { file("/var/log/boot.log"); }; destination imap { file("/var/log/imap.log"); }; destination auth { file("/var/log/auth.log"); }; destination cron { file("/var/log/cron"); }; destination console { file("/dev/console"); }; destination root { usertty("root"); }; destination allusers { usertty("*"); }; destination all { file("/var/log/all.log"); }; # Facility Filters filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # Level Filters filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info..emerg); }; filter f_debug { level(debug..emerg); }; # Filters filter f_messages { level(info..emerg) and (not facility(mail)) and (not facility(authpriv)); }; # Log all kernel messages to the console. log { source(s_sys); filter(f_kern); destination(console); }; # Log anything (except mail) of level info or higher. log { source(s_sys); filter(f_messages); destination(messages); }; # The authpriv file has restricted access. log { source(s_sys); filter(f_authpriv); destination(secure); }; # Log all the mail messages in one place. log { source(s_sys); filter(f_mail); destination(maillog); }; # Everybody gets emergency messages, plus log them on another machine. log { source(s_sys); filter(f_emerg); destination(allusers); }; # Save mail and news errors of level err and higher in a special file. log { source(s_sys); filter(f_uucp); filter(f_news); filter(f_crit); destination(spooler); }; # Save boot messages also to boot.log log { source(s_sys); filter(f_local7); destination(boot); }; # Log cyrus imap in seperate file log { source(s_sys); filter(f_local6); filter(f_debug); destination(imap); }; log { source(s_sys); filter(f_auth); filter(f_debug); destination(auth); }; # Debuging Sending all messages to all.log log { source(s_sys); destination(all); };

2 1

Can I prevent syslog-ng from prepending logs from other servers?
by Matt Mencel 20 Dec '00

20 Dec '00

I am recieving web and ftp logs from another machine on my central logging machine. Syslog-ng prepends the logs with a bunch of information that I don't need and it prevents Analog and Webalizer from parsing the logs correctly. Is there a way to tell syslog-ng not to prepend this information to certain logs? Thanks. Matt mmatt(a)freew3.com

6 10

RE: [syslog-ng]syslog-ng and sendmail
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 20 Dec '00

20 Dec '00

Sendmail logs two lines for each message. The other one should be above this one in the logfile. There is nothing wrong with your configuration. Regards, Drew > -----Original Message----- > From: Serge van Thillo [SMTP:tila@zeelandnet.nl] > Sent: Wednesday, December 20, 2000 2:40 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]syslog-ng and sendmail > > Hi people. > > I compiled syslog-ng today and tried out some things. > It works quite ok, there only a few things I am missing. > > When I log facility mail I only see to adressen. this is the same when I > log > everything to one file. > so for example: > > Dec 20 02:27:34 linux sendmail[10439]: eBK1RX410437: > to=<serge(a)mydomain.nl>, > delay=00:00:00, xdelay=00:00:00, mailer=cyrus, pri=38193, dsn=2.0.0, > stat=Sent > > Only the line telling me who send the message is missing. > > I will include the config file. Can anyone tell me what is wrong? > > Thanks in advance. > > Greets, > Serge. > --------------------------------- > > options { sync (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames (off); > use_dns (no); > use_fqdn (no); > create_dirs (no); > keep_hostname (yes); > }; > > source s_sys { unix-stream ("/dev/log"); internal(); }; > > destination console { file("/dev/console"); }; > destination messages { file("/var/log/messages"); }; > destination secure { file("/var/log/secure"); }; > destination maillog { file("/var/log/maillog"); }; > destination spooler { file("/var/log/spooler"); }; > destination boot { file("/var/log/boot.log"); }; > destination imap { file("/var/log/imap.log"); }; > destination auth { file("/var/log/auth.log"); }; > destination cron { file("/var/log/cron"); }; > destination console { file("/dev/console"); }; > destination root { usertty("root"); }; > destination allusers { usertty("*"); }; > destination all { file("/var/log/all.log"); }; > > # Facility Filters > filter f_auth { facility(auth); }; > filter f_authpriv { facility(authpriv); }; > filter f_cron { facility(cron); }; > filter f_daemon { facility(daemon); }; > filter f_ftp { facility(ftp); }; > filter f_kern { facility(kern); }; > filter f_lpr { facility(lpr); }; > filter f_mail { facility(mail); }; > filter f_news { facility(news); }; > filter f_security { facility(security); }; > filter f_user { facility(user); }; > filter f_uucp { facility(uucp); }; > filter f_local0 { facility(local0); }; > filter f_local1 { facility(local1); }; > filter f_local2 { facility(local2); }; > filter f_local3 { facility(local3); }; > filter f_local4 { facility(local4); }; > filter f_local5 { facility(local5); }; > filter f_local6 { facility(local6); }; > filter f_local7 { facility(local7); }; > > # Level Filters > filter f_emerg { level(emerg); }; > filter f_alert { level(alert..emerg); }; > filter f_crit { level(crit..emerg); }; > filter f_err { level(err..emerg); }; > filter f_warning { level(warning..emerg); }; > filter f_notice { level(notice..emerg); }; > filter f_info { level(info..emerg); }; > filter f_debug { level(debug..emerg); }; > > # Filters > filter f_messages { level(info..emerg) and (not facility(mail)) and (not > facility(authpriv)); }; > > # Log all kernel messages to the console. > log { > source(s_sys); > filter(f_kern); > destination(console); > }; > > # Log anything (except mail) of level info or higher. > log { > source(s_sys); > filter(f_messages); > destination(messages); > }; > > # The authpriv file has restricted access. > log { > source(s_sys); > filter(f_authpriv); > destination(secure); > }; > > # Log all the mail messages in one place. > log { > source(s_sys); > filter(f_mail); > destination(maillog); > }; > > # Everybody gets emergency messages, plus log them on another machine. > log { > source(s_sys); > filter(f_emerg); > destination(allusers); > }; > > # Save mail and news errors of level err and higher in a special file. > log { > source(s_sys); > filter(f_uucp); > filter(f_news); > filter(f_crit); > destination(spooler); > }; > > # Save boot messages also to boot.log > log { > source(s_sys); > filter(f_local7); > destination(boot); > }; > > # Log cyrus imap in seperate file > log { > source(s_sys); > filter(f_local6); > filter(f_debug); > destination(imap); > }; > log { > source(s_sys); > filter(f_auth); > filter(f_debug); > destination(auth); > }; > > # Debuging Sending all messages to all.log > log { > source(s_sys); > destination(all); > }; > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Syslog-ng adds unwanted entries to my logs...
by Matt Mencel 19 Dec '00

19 Dec '00

Let me try this again. Sorry for inconveniencing you all with multiple emails last night. I have several servers logging to one central server through a firewall. No big deal. However the central logging server is adding entries to the beginning of each line of each log. This is great for most of the logs as it lets me know where each entry came from. In the case of my web and ftp logs however this information is unnecessary and prevents Analog and Webalizer from parsing through the logs correctly. Here's an example from my httpd-access log on my logging server. Dec 19 08:22:28 otherserver root: www.somewebpage.com 123.123.123.123 - - [19/Dec/2000:08:22:28 -0600] "GET /index.html HTTP/1.1" 200 2026 http://www.somewebpage.com/ "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)" The stuff it adds, and that I don't want is everything up to the first entry of the virtualserver. In this case, www.somewebpage.com. So "Dec 19 08:22:28 otherserver root:" needs to be tossed out somehow. Is anyone else doing this or is it not possible to tell syslog-ng not to add these entries? Thanks for any help. Matt mmatt(a)freew3.com

2 1

Re: syslog-ng question on filter facility/priority
by Balazs Scheidler 19 Dec '00

19 Dec '00

> I would like to filter out kern.debug info from messages when we HUP > syslog-ng. I have set up a filter: "filter f_kern.debug { not > facility(kern); };" which filters out all kern messages from going to > /var/adm/messages. I set up another filter "filter f_kern { facility(kern); > };" that logs to destination file /var/log/kern.log" so I can pick up any > other kernel messages. Is there a way to set up a filter for facilty(kern) > that will filter out the debug info but still log the higher level messages > to /var/adm/messages? We are running on Solaris 2.6. filter f_kern { facility(kern) and not level(debug); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

3 3

Can I prevent syslog-ng from prepending logs from other servers?
by Matt Mencel 18 Dec '00

18 Dec '00

I am recieving web and ftp logs from another machine on my central logging machine. Syslog-ng prepends the logs with a bunch of information that I don't need and it prevents Analog and Webalizer from parsing the logs correctly. Is there a way to tell syslog-ng not to prepend this information to certain logs? Thanks. Matt mmatt(a)freew3.com

1 0

RE: [syslog-ng]filter(DEFAULT)
by Andrew Fort 18 Dec '00

18 Dec '00

> So it will have the opposite affect of what I wanted then... anything > that matches host1 will set match=1 and DEFAULT won't match. Heh, > somehow I find it amusing that my logic was completely backwards. Or > maybe I'm up too late. :-) Correct :) Your rules have two filter statements, it's only the filter(host1); and not the filter(DEFAULT); which is causing any action. -- afort

5 4

"Macros"
by Ohrberg, Mick 15 Dec '00

15 Dec '00

Gentlemen, I am trying to call external programs with syslog-ng and I would like to know if there's a complete list of macros (such as $PROGRAM, $HOST) out there somewhere. I have a piece of software that I want to trigger on certain conditions (host, type of message etc), and I would like to be able to pass these values as arguments in the program("...")-statement. Thanks in advance! Regards, -- Mick Öhrberg Open Systems Administrator, UMB Bank n.a [NYSE:FGP] Ph: (816)860-1064 Fax: (816)860-3934 PGP: http://www.worldinter.net/~aoao/PGP/pub.key.asc

2 1

File Creation Permissions
by Brian E. Seppanen 14 Dec '00

14 Dec '00

I've set up syslog-ng to create certain files with very specific permissions such as destination tvc.cisco { file("/var/log/cisco/tvc-cisco.$PRIORITY" owner("admin") group("apache") perm(0640));}; files are created with permissions 0600. What am I missing? Thanks, Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

2 1

RE: [syslog-ng]facility numbers
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 14 Dec '00

14 Dec '00

I'm not sure about the 9-14 codes but you can overload the other facilities. If you have them come in as different programs you can do something like this: filter f_prog1 { program("prog1") and facility(local1); }; filter f_prog2 { program("prog2") and facility(local1); }; I do this all the time and it works great. Regards, Drew > -----Original Message----- > From: Wendell Turner [SMTP:wturner@halcyon.com] > Sent: Wednesday, December 13, 2000 10:51 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]facility numbers > > > Sirs, > > Some questions about facilities and priorities: > > 1) I see from the stock sys/syslog.h file there is: > > #define LOG_UUCP (8<<3) /* uucp subsystem */ > #define LOG_CRON (15<<3) /* cron/at subsystem */ > /* other codes through 15 reserved for system use */ > > Have facility codes 9-14 ever been used? How could I use them for > my own logging? Would that interfere with any 'standard' syslog > functions? (I've already used the LOCAL0-7 ones, I would like > more.) The sl_facilities table in syslog-names.c doesn't seem to > allow for those in filters. > > 2) If that doesn't work, would it be proper to overload the stock > 0-8 items with my own? Would that 'confuse' any other logging > tools, or is it just a number used in the filtering? > > Thank you, > > Wendell Turner > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

facility numbers
by Wendell Turner 13 Dec '00

13 Dec '00

Sirs, Some questions about facilities and priorities: 1) I see from the stock sys/syslog.h file there is: #define LOG_UUCP (8<<3) /* uucp subsystem */ #define LOG_CRON (15<<3) /* cron/at subsystem */ /* other codes through 15 reserved for system use */ Have facility codes 9-14 ever been used? How could I use them for my own logging? Would that interfere with any 'standard' syslog functions? (I've already used the LOCAL0-7 ones, I would like more.) The sl_facilities table in syslog-names.c doesn't seem to allow for those in filters. 2) If that doesn't work, would it be proper to overload the stock 0-8 items with my own? Would that 'confuse' any other logging tools, or is it just a number used in the filtering? Thank you, Wendell Turner

1 0

RE: [syslog-ng]filter(DEFAULT)
by Andrew Fort 13 Dec '00

13 Dec '00

> What I have tried to do is log each service to its own file. At the > very bottom of the conf file I put: > > log { source(src); filter(f_host1); filter(DEFAULT); > destination(host1_messages); }; > etc. for host2 and host3 > > and finally another log line with ONLY filter(DEFAULT) for things that > don't get matched at all (which should never happen). > > However, what I am seeing appears to be that my host() > filters are being > ignored when using the DEFAULT filter with it. In other words, > unmatched log entries for host2 and host3 are appearing in > host1_messages. > > Is that correct behavior? It's the documented behaviour. Currently, I dont think syslog-ng can do "anything not already caught for this host" type filters; it's filtering logic is a little bit simpler than this.. The filter patch suggested for 1.5.0 (development release) forces the filters to be evaluated in the order they appear in the file, but essentially the logic is: - For each log line, match what is in the filter statement. If we get a hit, set the "match" flag. - Repeat for all futher filters (so multiple filters cause multiple matches, but match still =1). - When syslog-ng tests the "DEFAULT" filter, it only performs its action if match=0. This allows multiple filters to match out to multiple locations (useful), but doesn't allow the (arguably) also useful feature of excluding particular things as we go. I hope I got this right, I hope I'm close (this is the bit of syslog-ng i've been studying lately :) -- afort

2 1

filter(DEFAULT)
by William Yodlowsky 13 Dec '00

13 Dec '00

Hi, I'm sure I'm missing something... running 1.4.10 with libol-0.2.20 I setup some host filters like this: filter f_host1 { host("host1"); }; filter f_host2 { host("host2"); }; etc. Setup some service filters using match() ...and have several log statements for each host. What I have tried to do is log each service to its own file. At the very bottom of the conf file I put: log { source(src); filter(f_host1); filter(DEFAULT); destination(host1_messages); }; etc. for host2 and host3 and finally another log line with ONLY filter(DEFAULT) for things that don't get matched at all (which should never happen). However, what I am seeing appears to be that my host() filters are being ignored when using the DEFAULT filter with it. In other words, unmatched log entries for host2 and host3 are appearing in host1_messages. Is that correct behavior? Thanks in advance.

1 0

RE: [syslog-ng]syslog-ng question on filter facility/priority
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 12 Dec '00

12 Dec '00

Yes, you set up a logical filter. filter f_kern.debug { facility(kern) and level(debug); }; filter f_kern { facility(kern) and not level(debug); }; Hope it helps. Regards, Drew > -----Original Message----- > From: Ann Markley [SMTP:amarkley@aventail.com] > Sent: Tuesday, December 12, 2000 12:52 AM > To: 'syslog-ng(a)lists.balabit.hu' > Subject: [syslog-ng]syslog-ng question on filter facility/priority > > I would like to filter out kern.debug info from messages when we HUP > syslog-ng. I have set up a filter: "filter f_kern.debug { not > facility(kern); };" which filters out all kern messages from going to > /var/adm/messages. I set up another filter "filter f_kern { > facility(kern); > };" that logs to destination file /var/log/kern.log" so I can pick up any > kernel messages. Is there a way to set up a filter for facilty(kern) that > will filter out the debug info but still log the higher level messages to > /var/adm/messages? We are running on Solaris 2.6. > > Thanks! > > Ann Markley > Systems Engineer > amarkley(a)aventail.com > > Aventail Corporation > www.aventail.com > > > > Ann Markley > Systems Engineer > amarkley(a)aventail.com > > Aventail Corporation > www.aventail.com > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

syslog-ng question on filter facility/priority
by Ann Markley 11 Dec '00

11 Dec '00

I would like to filter out kern.debug info from messages when we HUP syslog-ng. I have set up a filter: "filter f_kern.debug { not facility(kern); };" which filters out all kern messages from going to /var/adm/messages. I set up another filter "filter f_kern { facility(kern); };" that logs to destination file /var/log/kern.log" so I can pick up any kernel messages. Is there a way to set up a filter for facilty(kern) that will filter out the debug info but still log the higher level messages to /var/adm/messages? We are running on Solaris 2.6. Thanks! Ann Markley Systems Engineer amarkley(a)aventail.com Aventail Corporation www.aventail.com Ann Markley Systems Engineer amarkley(a)aventail.com Aventail Corporation www.aventail.com

1 0

Preventing syslog-ng from halting if a source is not found
by Nick DeClario 11 Dec '00

11 Dec '00

I am having difficulty trying to setup syslog-ng to continue running if a source is not found. Right now I have it scanning /dev/log and /var/chroot/named/dev/log on my Linux system. In some cases the /var/chroot/named/dev/log will not exist on some systems I have here. Is there a way I can setup the configuration file to say if /var/chroot/named/dev/log doesn't exist to simply ignore it and not look for logs there at all? Right now syslog-ng refuses to start if it doesn't exist. -Nick

1 0