- syslog-ng - lists.balabit.hu

Filtering confusion.
by Brian Leveille 08 Dec '00

08 Dec '00

All, I have a config I need help with: I have 2 Linux boxes running syslog-ng behind a Foundry ServerIron load balancing switch, which provides both load sharing and redundancy. The Foundry maintains it's server farm by both pings and actual syslog messages. It does this by sending garbage to the specified UDP port (514). If it receives a 'Port Unavailable' message, the service must no longer be running and the Foundry removes the server from the farm and redirects traffic to available servers. If it receives nothing, it assumes the service must be running and the message was received successfully. My problem is that my syslog-ng receives this message and processes it. My conf dictates that anything coming over udp 514 get written to a $HOST macro and $DATE macro expanded filename. So, I end up with a directory that contains files with garbage messages from the Foundry switch. How do I put a filter in to redirect these garbage test messages? Preferably redirecting them to pipe("/dev/null"). My foundry is called ns-foundry1 in my DNS server and it's IP is 208.3.134.90. The config file below allows the Foundry garbage messages to hit on the second log statement (log { source(src); destination(everything); };), which is bad. Thanks for your help... Here is my config file: options { sync(0); #use_dns(no); create_dirs(yes);}; source foundry { udp(ip("208.3.134.90") port(514)); }; source int { unix-stream("/dev/log"); internal(); }; source src { udp(port(514)); }; destination everything { file("/NetscreenLogs/$HOST/$HOST.$MONTH-$DAY-$YEAR.log" owner(NetscreenLogs) group(NetscreenLogs) perm(0777) dir_perm(0777)); }; filter foundryfilt { host("ns-foundry1"); }; destination void { pipe("/dev/null"); }; destination internallogs { file("/var/log/messages"); }; log { source(foundry); filter(foundryfilt); destination(void); }; log { source(src); destination(everything); }; log { filter(DEFAULT); destination(internallogs); }; Brian Leveille ------------------- Senior Internetworking Engineer DefendNet Solutions, Inc. www.defendnet.com

1 0

Question....
by Sami Saleh 07 Dec '00

07 Dec '00

We're trying to configure syslog-ng to only accept logs from specific servers. Here is the code we've implemented within syslog-ng.conf. options { long_hostnames(off); sync(0); }; source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(192.168.1.20,514); }; However, we get the following error when we start the daemon: parse error at 5 Parse error reading configuration file, exiting. The objective is to only allow certain hosts to log to this server. Any help would be appreciated. Sami

3 4

Host matching
by Brian E. Seppanen 06 Dec '00

06 Dec '00

Ok, my previous message about it not creating the files. Forget it. My host patterns aren't matching, and the macro expansion works just fine. However. I have a couple of hosts that have lengthy names and don't seem to be cooperating. filter router {host("router-2-fe0-1-bb-vl4");}; I've taken exactly what appears in my message files and put it into this filter. However, the filter won't match. Would this be a problem with all of the - characters? I've attempted to escape these characters with \. How can I match these hostnames? Thanks, Brian Seppanen Charter Communications Regional Data Center 906-228-3100 ext 23 Marquette, MI seppy(a)chartermi.net

1 1

Using File Macros.
by Brian E. Seppanen 06 Dec '00

06 Dec '00

Hi: I just got a working config going. I'm trying to set up my config to auto create files based on Priority Level. The files are not being created. What am I missing? These are logs from cisco routers that have been configured to log to this host. source udp_src {udp();}; destination up.cisco { file("/var/log/cisco/up.cisco.$PRIORITY");}; log { source(udp_src); filter(esc7223); filter(imt7206); destination(up.cisco);$ It was working previously with syslog, and I know that I'd get some output immediately. Also does this auto create files? What is the proper way of shutting down the daemon? Will it take -HUP -USR1 or any of the other signals? Thanks for the help. Brian Seppanen Charter Communications Regional Data Center 906-228-3100 ext 23 Marquette, MI seppy(a)chartermi.net

1 0

BSDi strptime function ?
by Bharath Aleti 06 Dec '00

06 Dec '00

Hi Wanted to know if anyone on this list had any success with a function to replace strptime() function for BSDi ? Any inputs (pros and cons) regarding working with syslog-ng on BSDi systems are most welcome. Thanks in advance Bharath Aleti

3 3

TCP based Windows syslog client
by Dan Schleifer 06 Dec '00

06 Dec '00

Howdy Folks, I've been looking at syslog clients for windows, and have not yet found one that can do tcp based logging. Does anyone know of such a program (OpenSource/Commercial/Free Software, doesn't matter)? I'm in the unfortunate situation of needing to log events from about 100 NT machines, and would rather not rely upon UDP... Thank. -Dan -- Dan Schleifer | 804.242.5088 | dan(a)soyjew.com Super Jew

3 2

Encryption?
by Brian E. Seppanen 06 Dec '00

06 Dec '00

Hello: I've started looking into using syslog-ng and it looks very nice. I was curious about the encryption option in the sample config. How is that accomplished? Where would the documentation for that option be? How comparible is syslog-ng to syslog in performance terms? Obviously encryption would increase the load and that is acceptable to a point. Thanks for your assistance. Brian Seppanen Charter Communications Regional Data Center 906-228-3100 ext 23 Marquette, MI seppy(a)chartermi.net

2 1

Re: Syslog-ng and SNMP traps
by Balazs Scheidler 06 Dec '00

06 Dec '00

> Sorry if this is a stupid question. > As I don't know many things about SNMP > by reading the documentation for syslog-ng > I didn't understand whether syslog-ng > can actually send SNMP traps or not. > If it does, how does it do it? syslog-ng by itself cannot send SNMP traps, but you can extend it with a small program which can. For example: source src { unix-stream("/dev/log"); internal(); }; destination traps { program("/usr/local/sbin/sendtraps"); }; log { source(src); destination(traps); }; And /usr/local/sbin/sendtraps contains: #!/bin/sh while read line; do snmptrap ... done of course you might need to filter messages going out as traps. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

couple of questions about configs
by Deja User 01 Dec '00

01 Dec '00

Hi All, I'm running ver 1.4.9a and I'm need of some assistance on the configs, I'm going to be using syslog to receive remote messages from approximately 60+ routers. the problem I'm having is that I cant seem to set up syslog-ng to run in real time. By doing an strace I do see that I'm receiving the message but syslog appears to hold them and dump multiple messages at one time, I've enabled sync(0) but that doesn't seem to help. Second is that when syslog-ng does write to the file it removes the carriage returns at the end of the lines, thus making it difficult to read. Below is a copy of my test config, any suggestions would be appreciated. Aaron options { sync(0); use_dns(NO); create_dirs(yes); }; source UDP { udp(); }; destination ATLSSR1 { file("logs/ATLSSR1.html"); }; destination Default { file("logs/default.html"); }; filter ATLSSR1 { host(10.192.224.1); }; log { source(UDP); filter(ATLSSR1); destination (ATLSSR1); }; log { source(UDP); filter(DEFAULT); destination(Default); }; ------------------------------------------------------------ --== Sent via Deja.com http://www.deja.com/ ==-- Before you buy.

1 0

syslog-ng 1.4.10 and 1.5.0
by Balazs Scheidler 30 Nov '00

30 Nov '00

I've released syslog-ng 1.4.10 with the patch I posted recently applied. 1.5.0 is also released containing the feature suggested by Andrew Fort <afort(a)staff.webcentral.com.au>. You can find these at the usual places: http://www.balabit.com/products/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

RE: [syslog-ng]syslog-ng 1.4.10 and 1.5.0
by Andrew Fort 29 Nov '00

29 Nov '00

Just for the record, Any credit for the patch mentioned (to 1.5.0) patch should actually go to Matthew Melvin <matthewm(a)staff.webcentral.com.au> ; he wrote it :-) -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Wednesday, 29 November 2000 22:01 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.4.10 and 1.5.0 I've released syslog-ng 1.4.10 with the patch I posted recently applied. 1.5.0 is also released containing the feature suggested by Andrew Fort <afort(a)staff.webcentral.com.au>. You can find these at the usual places: http://www.balabit.com/products/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: syslog-ng filter order patch
by Balazs Scheidler 29 Nov '00

29 Nov '00

Hi, I've read your posting and had a quick glance at your patch. I've applied it now with a few changes: 1) I changed the list append routine to append at the end of the list, so default statements should go last 2) the patch didn't unref the message it was distributing, so syslog-ng may become a memory hog quickly. 3) I branch the 1.4.x tree to 1.5.x and apply this patch there. Expect an 1.4.10 and 1.5.0 release soon. > Balazs, this is the patch for syslog-ng I posted to the list the other day, > I was wondering if you'd take a quick look if you haven't been reading the > list.. > > I've have this working against 1.4.9a (with the 1.4.9a patch from the > mailing list also applied, which I needed to stop logs being mixed up on my > RedHat 6.2/Linux 2.2.16 box). > > This patch changes only the order of evaluation of rules in the log{} lines > > Since the only time you check to see if a log entry has 'already matched' is > when you test for the DEFAULT filter, if you have a rule with no filter, > your logic will cause the DEFAULT filter to never be handled, because > "everything has matched" and do_distribute_log forces DEFAULT to be handled > last. > > The patch just makes the filters get evaluated in the order they appear in > the linked list, which allows configurations like the following: > > log { source(s_sys); destination(d_tty12); }; > log { source(s_sys); filter(DEFAULT); destination(d_mesg); }; > log { source(s_sys); filter(f_PAM); destination(d_pam); }; > log { source(s_sys); filter(f_auth); destination(d_auth); }; > log { source(s_sys); filter(f_filter4); destination(d_mail); }; > > To have a 'match everything from s_sys' to go to my /dev/tty12 for console > debugging, as well as match a default rule, since the DEFAULT is evaluated > before the rule without a filter. > > The patch was written by my workmate, Matthew Melvin > (matthewm(a)staff.webcentral.com.au) > > --snip-- > > --- src/center.c.old Mon Nov 27 14:20:14 2000 > +++ src/center.c Mon Nov 27 15:08:38 2000 > @@ -71,14 +71,21 @@ > static void do_distribute_log(struct log_handler *c, struct log_info *msg) > { > CAST(log_center, self, c); > - struct log_connection *p, *def_connection = NULL; > + struct log_connection *p; > int match = 0; > > for (p = self->connections; p; p = p->next) { > struct log_endpoint_info *s; > > if (p->flags & LOG_CONN_DEFAULT) { > - def_connection = p; > + struct log_endpoint_info *d; > + if (match) continue; > + for (d = p->nodes; d; d = d->next) { > + if (d->type == EP_DESTINATION) { > + assert(d->ref); > + HANDLE_LOG(d->ref, > log_info_use(msg)); > + } > + } > continue; > } > for (s = p->nodes; s; s = s->next) { > @@ -107,16 +114,6 @@ > > next_connection: > } > - if (!match && def_connection) { > - struct log_endpoint_info *d; > - for (d = def_connection->nodes; d; d = d->next) { > - if (d->type == EP_DESTINATION) { > - assert(d->ref); > - HANDLE_LOG(d->ref, log_info_use(msg)); > - } > - } > - } > - log_info_free(msg); > } > > struct log_handler *make_log_center(struct log_connection *connections) > > --snip-- > > > -- > Andrew Fort -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

secure remote syslog
by Frank Nijenhuis 29 Nov '00

29 Nov '00

ok, got it working. syslog-ng tunneled with stunnel, below a quick&dirty howto for the archives. As for now I've got two hosts logging to the loghost and i certainly don't know what performance and results will be when there are 10 or more hosts heavily logging. Install openssl, latest (0.9.6 - www.openssl.org) install stunnel (www.stunnel.org) Compile openssl, stunnel, probably out of the box up&running). Add to /etc/services on all hosts: syslog-ngs 1801/tcp #syslog-ng secure syslog-ng 1800/tcp #syslog-ng (or whatever port you would like). syslog-ng config on loghost: source remote { tcp(ip("<ip of localhost>") port(1800));}; stunnel on loghost: /usr/local/sbin/stunnel -p /opt/install/stunnel-3.8p4/stunnel.pem -d syslog-ngs -r <ip of the loghost>:syslog-ng syslog-ng config on other hosts: destination remote { tcp("<ip of localhost>" port(1800)); }; stunnel config on the other hosts: /usr/local/sbin/stunnel -c -d syslog-ng -r <ip of the loghost>:syslog-ngs restart or start all three syslog-ng's and verify the logging. Frank Nijenhuis.

1 0

linux kernel message
by Georgi Chorbadzhiyski 29 Nov '00

29 Nov '00

Hi! After installing syslog-ng. I no longer can log my kernel messages. I'm using Slackware 7.1 with klogd 1.4 and syslog-ng 1.4.9a. Yes klogd is running and with original syslogd everything was just fine. source src2 { unix-dgram("/dev/log"); }; ^^^^^^^^^^ I put this here because in this mailing list somebody suggested using this on RedHat > 6 It doesn't work :-( Georgi Chorbadzhiyski System Administrator top.bg Here is my configuration file. options { long_hostnames(on); sync(0); }; source src { unix-stream("/dev/log"); internal(); }; source src2 { unix-dgram("/dev/log"); }; destination kern { file("/var/log/kern.log"); }; destination tty11 { file("/dev/tty11"); }; destination tty12 { file("/dev/tty12"); }; filter f_kern { facility(kern); }; log { source(src); filter(f_kern); destination(kern); destination(tty11); }; log { source(src2); filter(f_kern); destination(kern); destination(tty12); };

1 0

Security and Integrity support?
by Yazz D. Atlas 29 Nov '00

29 Nov '00

Anyone know when syslog-ng will be supporting encryption and digital signatures for file integrity. Plus is there a way to only allow connections to the main syslog-ng server based on for example 10.2.*.* Also the doc's are just "a little" out of date and the syslog-ng.conf.demo is confussing since the syslog-ng.ps document states as of 1.3.4 encrypt() and compress() are nolonger supported. What about mac() and authentication() are they supported? Yazz Atlas -- Yazz D. Atlas <yazz(a)osdn.com> Systems and Network Engineer O | S | D | N, 50 Nagog Park, Acton, MA 01720 http://www.osdn.com/ Open Source Development Network

4 4

secure remote logging...
by Frank Nijenhuis 28 Nov '00

28 Nov '00

I need a way of secure remote logging for an part of our network connected to internet, I know the most secure way would be first of add another interface to all hosts and connect them to a private network with the loghost, but that's not possible right now. Is there anyone here who has set up some sort of encrypted log network with multiple hosts logging to one logserver? I was looking at stunnel, tunnel through ssl and using the tcp log function of syslog-ng. Can anyone here confirm that this is a setup which should work ? (stunnel works with ssl and can be found at www.stunnel.org) Any comments on a secure setup would be more than welcome! Frank Nijenhuis

1 0

www.goliat.hu - Hallott mar rola ?
by marketing＠goliat.hu 27 Nov '00

27 Nov '00

Tisztelt Internet felhasználó! http://www.goliat.hu - Új keresõ a magyar weben! A vezetõ technológiával készített keresõrendszer kivételesen felhasználóbarát, nagyon gyors, hatékony és nagy adatbázissal rendelkezik. Keressen és találjon ! http://www.goliat.hu A keresõ metódus mellett rendelkezik egy "témakörök" nevû linkgyûjteménnyel is, amely 28 témában segíti az interneten való gyors eligazodást. Ezek a http://www.goliat.hu legfõbb ismérvei! Egy próbát megér! --------------------------------------------------------------- E-mail címéhez az Interneten elhelyezett oldalakon találtunk rá ! Amennyiben nem óhajt több információt kapni Tõlünk, kérjük írjon a bug(a)goliat.hu címre. Figyelmét és türelmét köszönjük! GFX Média

1 0

www.goliat.hu - Hallott mar rola ?
by marketing＠goliat.hu 27 Nov '00

27 Nov '00

Tisztelt Internet felhasználó! http://www.goliat.hu - Új keresõ a magyar weben! A vezetõ technológiával készített keresõrendszer kivételesen felhasználóbarát, nagyon gyors, hatékony és nagy adatbázissal rendelkezik. Keressen és találjon ! http://www.goliat.hu A keresõ metódus mellett rendelkezik egy "témakörök" nevû linkgyûjteménnyel is, amely 28 témában segíti az interneten való gyors eligazodást. Ezek a http://www.goliat.hu legfõbb ismérvei! Egy próbát megér! --------------------------------------------------------------- E-mail címéhez az Interneten elhelyezett oldalakon találtunk rá ! Amennyiben nem óhajt több információt kapni Tõlünk, kérjük írjon a bug(a)goliat.hu címre. Figyelmét és türelmét köszönjük! GFX Média

1 0

RE: [syslog-ng]config questions
by Andrew Fort 27 Nov '00

27 Nov '00

Okay, I think I see what you mean now, since I see this behaviour also. We noticed this since we have a couple of "catch-all" rules in our confile file, i.e., log {} entries with a source and destination, but no filter. For instance, log { source(s_sys); destination(d_tty12); }; to write everything logged at source s_sys to destination d_tty12, no exceptions. However, this changes the behaviour of the DEFAULT filter. One of our other sysadmins and I have traced through the soruce, and he (Matthew Melvin) has written a patch, which I'll attempt to explain. When the config file syslog-ng.conf is read (from beginning to end), the linked list "self" (ptr stuct syslog_config) is created, inside "do_init_config()" (src/cfgfile.c) When you create a linked list, the easiest way is to link the ptr to the list as the 'next' variable in the current list entry, essentially pushing list entries onto the stack. So when the list is read forwards, you're reading _backwards_ through the order in the config file (the list reads; last entry through to first entry in the config file, in other words). In center.c, function do_distribute_list evaluates the linked list to write the log message being currently processed to all valid destinations. The logic in the code provided is to always treat the DEFAULT rule last - no matter its position within the linked list, and treat all other rules first. However, if you have a catch-all rule (no filter), the code which causes the log message to be handled sets a "match" flag to true. When we get to the end, and it's time to handle the default rule, it checks to see if the log message being currently processed has already been matched and if a DEFAULT rule is set: if (!match && def_connection) { Since we've already matched everything, the DEFAULT rule does nothing. Matthew's patch changes this logic so that all rules are evaluated in the exact order they appear in the linked list (remember, this is the reverse order they appear in the config file). So, by applying this patch, then placing your "catch-all" rule(s) first in the config file, then the DEFAULT rule next, then any other rules, you should get the behaviour that you expect. Credits for this patch go to Matthew Melvin (matthewm(a)staff.webcentral.com.au) To apply the patch below: Since we've modified center.c, make_class must run, so you'll need to have scsh (scheme shell) installed, and you'll need to rebuild libol if you've updated the scheme shell libraries (otherwise you'll get a segfault when running the updated syslog-ng). If you're having problems with the scheme_shell bit, you may need to modify make_class to point at scheme shell's path explicitly. Apply the patch via changing to the directory you extracted the syslog-ng source into (e.g. /usr/local/src/syslog-ng-1.4.9a/), save the patch file below to a file, and run patch -p0 < /path/to/patchfile.below Then rebuild syslog-ng: ./configure, make, make install. --snip-- --- src/center.c.old Mon Nov 27 14:20:14 2000 +++ src/center.c Mon Nov 27 15:08:38 2000 @@ -71,14 +71,21 @@ static void do_distribute_log(struct log_handler *c, struct log_info *msg) { CAST(log_center, self, c); - struct log_connection *p, *def_connection = NULL; + struct log_connection *p; int match = 0; for (p = self->connections; p; p = p->next) { struct log_endpoint_info *s; if (p->flags & LOG_CONN_DEFAULT) { - def_connection = p; + struct log_endpoint_info *d; + if (match) continue; + for (d = p->nodes; d; d = d->next) { + if (d->type == EP_DESTINATION) { + assert(d->ref); + HANDLE_LOG(d->ref, log_info_use(msg)); + } + } continue; } for (s = p->nodes; s; s = s->next) { @@ -107,16 +114,6 @@ next_connection: } - if (!match && def_connection) { - struct log_endpoint_info *d; - for (d = def_connection->nodes; d; d = d->next) { - if (d->type == EP_DESTINATION) { - assert(d->ref); - HANDLE_LOG(d->ref, log_info_use(msg)); - } - } - } - log_info_free(msg); } struct log_handler *make_log_center(struct log_connection *connections) --snip-- An example of what I mean by our filter rules is: log { source(s_sys); destination(d_tty12); }; log { source(s_sys); filter(DEFAULT); destination(d_mesg); }; log { source(s_sys); filter(f_PAM); destination(d_pam); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; I hope this helps! Balazs, this may not be your preferred method of handling this logic, but Matthew and I would appreciate hearing from you about it.. -- Andrew Fort Webcentral > >>>>> "AF" == Andrew Fort <afort(a)staff.webcentral.com.au> writes: > > AF> Is any local logging working? If not, is your local source input > AF> configured correctly for your operating system? > > Apart from filter(DEFAULT), everything seems dandy:

1 0

Re: [syslog-ng]syslog-ng 1.4.9a mixing up log sources?
by kent＠unit.liu.se 25 Nov '00

25 Nov '00

Andreas Östling <andreaso(a)it.su.se> writes: > > can you check if this one fixes your problem: > > The patch seems to work for me. I agree. I have not seen any more "mixed-up lines" since I applied the patch. A quick 'egrep "<[0-9]*>" *' did not find anything today. Regards, -- Kent Engström, Linköping University Incident Response Team kent(a)unit.liu.se abuse(a)liu.se +46 13 28 1744 UNIT, Linköping University; SE-581 83 LINKÖPING; SWEDEN

1 0

syslog-ng 1.4.9a mixing up log sources?
by kent＠unit.liu.se 25 Nov '00

25 Nov '00

Today, I upgraded to 1.4.9a on our Solaris log server. Some hours later, my "logcheck clone" reported strange things; our webserver's logs contained lines for netsrvm (part of the Mimer database). However, we do not run Mimer on that machine, but on some others. Sample log line (host names/IP:s changed): Nov 24 13:29:08 web.example/web.example netsrvm[15501]: connect from mimerclient.example<30>sshd[9892]: log: Connection from 192.168.1.1 port 57733 The second part could be a correct entry for the web machine. Please contact me personally if unmodified log lines are needed for some debugging. -- Kent Engström, Linköping University Incident Response Team kent(a)unit.liu.se abuse(a)liu.se +46 13 28 1744 UNIT, Linköping University; SE-581 83 LINKÖPING; SWEDEN

3 4

Problems with PID file
by Martin Grimsehl 24 Nov '00

24 Nov '00

hi everybody, we use syslog-ng in a large cluster of some online services. however we do encounter problems with the pid-file handling. i start syslog-ng as syslog-ng --pidfile=/var/run/syslog-ng.pid --cfgfile=/usr/global/etc/syslog-ng.conf and its running fine. yesterday i did: # ps auxw| grep syslog-ng root 5366 ...syslog-ng --pidfile=/var/run/syslog-ng.pid... # cat /var/run/syslog-ng.pid 5366 today i did: # ps auxw| grep syslog-ng root 18357 ...syslog-ng --pidfile=/var/run/syslog-ng.pid... # cat /var/run/syslog-ng.pid 5366 so for some mysterious reasons a) syslog-ng restarts (maybe some cron job to logrotate the systems syslog) b) the pid in /var/run/syslog-ng.pid does not get updated syslog-ng is running here on Tru64 4.0 alpha. martin

2 1

Re: DoS possibility in syslog-ng
by Balazs Scheidler 24 Nov '00

24 Nov '00

> Upgrade syslog-ng to 1.4.9, which is a security upgrade, and changes > nothing compared to 1.4.8 or apply this patch: > > I am looking for the 1.4.9a tar ball, but the "1.4.x (stable branch)" > section doesn't list it. Do you have a direct URL for the tar ball? /downloads/syslog-ng/1.4/ I forgot to update the download url, though it points to the 1.4.9a tarball (even if it still references to 1.4.9) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

RE: [syslog-ng]config questions
by Andrew Fort 23 Nov '00

23 Nov '00

> I think it's syslog-ng, f ex I have > > filter f_lpr { facility(lpr) and not level(debug..info); }; > > and logging to lpr.debug does not end up anywhere (and there's no > other filter that takes care of *.debug or anything). Strange, Is any local logging working? If not, is your local source input configured correctly for your operating system? -- afort

2 1

RE: [syslog-ng]config questions
by Andrew Fort 23 Nov '00

23 Nov '00

> AF> yep, there is a predefined filter named "DEFAULT" which should do > AF> what you're after. > > Ah, you're quite right. Though > > destination default { file("/var/log/default-$YEAR$MONTH$DAY"); }; > log { source(src); filter(DEFAULT); destination(default); }; > > doesn't seem to work, no file is created. Any ideas? Are any messages from source(src) making it to the default filter? If not, no file will ever be created. Find a situation your other rules dont cater for (an unusual facility, for instance), and use 'logger' to create log messages to see if the problem is syslog-ng or simply you dont have any 'extra' messages which need catching by a default rule. -- afort

2 1