- syslog-ng - lists.balabit.hu

Re: syslog-ng digest, Vol 1 #293 - 10 msgs
by Emil Obermayr 08 Nov '00

08 Nov '00

> so delimiting the message with spaces should give you the correct results. --- > How do you reliably determine the incoming fields? AFAIK, there is no > RFC nor standard for syslog - it is ad hoc. severities/levels and facilities are two fields for example that the syslogd knows and that are filter-able but so far they are not available in the syslog itself. Especially with the database-solution I have in mind it would be very nice to have them in the output, too. BTW: Did you had a look at the perl-module SyslogScan::SyslogEntry? This one seems to have some nice features that could get included in syslog-ng. I look forward to the futures enhancements and I allready like syslog-ng. Thanks for coding it. -- _/ _/ _/ Emil Obermayr QEDEMOB @ EED/E/P _/ _/ _/ fone +49-5121-707-356 fax: -170 _/ _/ _/ http://www.ericsson.de/ecc/fue/standort.html#hildeshm _/ _/ _/ Ericsson Eurolab Deutschland GmbH, Hildesheim, Germany

1 0

syslog-ng 1.4.8 released
by Balazs Scheidler 07 Nov '00

07 Nov '00

Here's the NEWS entry: News for the 1.4.8 release (11/03/2000) Fixed memory leak in destination files (occured if you had several macro-expanded files) Added some new expansion macros: HOUR, MIN and SEC. Some new global options: time_reap() the number of seconds when an idle destination file is closed use_time_recvd()if you want your date expansion macros to use the received time, instead of the time specified in the log message. Updated documentation to include the changes above. Added contrib subdirectory to include init scripts and config files for various platforms. Scott, this should fix your memory problems. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 2

destination-feature
by Emil Obermayr 07 Nov '00

07 Nov '00

relating to my last question about SQL-output another idea: the destination-function should have an printf-like option so you can format the output the way you like it; specially for the programm-destination it would be nice to have separators for the different fields to let the program handle and process these during runtime with each message. -- _/ _/ _/ Emil Obermayr QEDEMOB @ EED/E/P _/ _/ _/ fone +49-5121-707-356 fax: -170 _/ _/ _/ http://www.ericsson.de/ecc/fue/standort.html#hildeshm _/ _/ _/ Ericsson Eurolab Deutschland GmbH, Hildesheim, Germany

3 3

Re: syslog-g and bsdi
by Balazs Scheidler 07 Nov '00

07 Nov '00

> I was wondering if anyone has a compatible function to replace strptime. > this is a function that is not included in BSDI (4.0+ a least) > if no one has coded a replacement, i would be willing to add another patch > to fix it. > otherwise, you should take off "this has been compiled for bsdi" on the Thanks. you may be interested in the glibc sources, it should have an strptime implementation. I don't know how much it depends on internal libc stuff though. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Hi all,. does anyone know of a compiled RPM for SysLog-NG?
by todd glassey 07 Nov '00

07 Nov '00

I would like to find out if there are any RedHat 6.1 compliant RPM's for Syslog-NG out there. Or does someone have a binary copy that they could send me? Thanks Todd

3 6

RE: [syslog-ng]PTR lookups; leak/crash fixes
by Ohrberg, Mick 07 Nov '00

07 Nov '00

[snip] > But now there is a bunch of extra CPU usage (syslog-ng has accumulated 600 > minutes of CPU time after running for just one day; this is a 333Mhz machine and > there are only a couple dozen logging hosts, most of which comes relayed > through other syslog-ngs anyways). [snip] I keep thinking I'm doing something wrong... I have syslog-ng running on a SUN Ultra 10, and it's been running for 192 days, and I have 700 minutes time and 4.5M size... Of course, I only log from 6 other boxes to it for now. :) Consider this a success story :) I have used syslog-ng to split up incoming logs per facility and priority, so that if I see a message in the crit file, I can go to the corresponding facility file and see if there were any more message. This functionality has come in very handy a few times. :) /Mick

7 23

RE: [OT] distributed UNIX FS layout policy (was Re: [syslog-ng]Hi all,. does anyone know of a compiled RPM for SysLog-NG?)
by Hamilton, Andrew Mr. 07 Nov '00

07 Nov '00

We use /opt but not /pkgs. Most of the software I compile or install is either in /opt, one of the system dirs /usr/sbin, /usr/bin, or in /usr/local. We use pretty much the same set up as you except for /pkgs. /usr/local is auto-mounted, /opt is local to machine. It works out fairly well that way. Regards, Drew Hamilton > -----Original Message----- > From: Scott McDermott [SMTP:mcdermot@questra.com] > Sent: Monday, November 06, 2000 11:57 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [OT] distributed UNIX FS layout policy (was Re: > [syslog-ng]Hi all,. does anyone know of a compiled RPM for SysLog-NG?) > > This is an off-topic post so please delete if you aren't interested. > > > > Whoops, apologies; I meant to send this privately. Please reply to > > > me privately and not the list. > > Guess you didn't see that part. Oh well, I have a question to ask of > the list. > > todd glassey on Mon 6/11 14:04 -0800: > > The /opt/local version will work for me. We use a somewhat Solaris > > mindset in our systems layout. > > I am curious if other admins use /opt/local/ ? Our layout looks like > this: > > /home/ automount NFS homes > > /usr/local/ automount-by-arch for site-wide bin, lib, sbin > and friends > > /opt/ local-to-machine package-type stuff (has own > bin, lib, sbin and friends for each package) > > /opt/local/ local-to-machine single bin, lib, sbin and > friends (would put this in /usr/local/ but since > that is distributed, won't work). > > /pkgs/ identical to /opt/ but distributed and > automounted-by-arch > > I am just curious how other admins lay out their filesystems, I have > never heard of anyone using /opt/local/ or /pkgs/ and was wondering if I > happened to make up stuff that coincided with other admins' thoughts on > the matter? /pkgs/ existed before I was here but /opt/local/ was my > idea. Anyone else use it? > > Oh BTW maybe I can be somewhat on-topic: the central loghost logs to > /var/log/syslog/host/program/year.month.day and exports /var/log/syslog > using an ACL of admin workstations only. This lets us view logs for any > host with nice granularity, from any admin workstation. Wondering how > others do this also? Leave it on central host and login to the machine? > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

SQL destination planned
by Emil Obermayr 06 Nov '00

06 Nov '00

Hi, I just configure syslog_ng for my network and I am up to collect the data in a mysql-database. Are there any plans to include a sql-destination in syslog_ng? If not I will code something. Bye! -- _/ _/ _/ Emil Obermayr QEDEMOB @ EED/E/P _/ _/ _/ fone +49-5121-707-356 fax: -170 _/ _/ _/ http://www.ericsson.de/ecc/fue/standort.html#hildeshm _/ _/ _/ Ericsson Eurolab Deutschland GmbH, Hildesheim, Germany

1 0

Kernel messages
by Erich Reitz 04 Nov '00

04 Nov '00

Hi, I run a RedHat 7 system (just upgraded from 5), and don't understand why my previous configuration of syslog-ng (1.4.7) doesn't log kernel messages with rh7, especially those from the IP Chains Packet log. These messages were logged with syslog, but no longer with syslog-ng: example: Nov 3 08:25:34 machine kernel: Packet log: input DENY eth0 PROTO=17 192.41.21.11:123 21.21.1.2:123 L=76 S=0x10 I=31802 F=0x0000 T=14 (#38) I do run klogd and these messages still show up if I issue a "dmesg" I've tried starting klogd before and after syslog-ng, but that doesn't seem to make a difference. Does anyone have any hints? Thanks. My config file: options { long_hostnames(off); sync(0); time_reopen(10); log_fifo_size(100); }; source src { unix-stream("/dev/log"); internal(); }; destination fw { file("/var/log/firewall"); }; destination ftpd { file("/var/log/ftpd"); }; destination sendmail { file("/var/log/maillog"); }; destination cron { file("/var/log/cron"); }; destination sshd { file("/var/log/sshd"); }; destination all { file("/var/log/ng-log"); }; destination dst { file("/var/log/msgs"); }; filter fw { match("Packet"); }; filter ftpd { program("ftpd"); }; filter sendmail { program("sendmail"); }; filter cron { program("CROND"); }; filter sshd { program("sshd"); }; filter remain { not program("CROND") and not program("ftpd") and not program("sshd") and not program("sendmail") and not match("Packet") ; }; log { source(src); filter(fw); destination(fw); }; log { source(src); filter(ftpd); destination(ftpd); }; log { source(src); filter(cron); destination(cron); }; log { source(src); filter(sshd); destination(sshd); }; log { source(src); filter(sendmail); destination(sendmail); }; log { source(src); filter(remain); destination(all); }; log {source(src); destination(dst); };

2 1

new destination-file with group zzz
by Wolfgang Koessler 03 Nov '00

03 Nov '00

hello, I have some problems with the group of new destination-files of syslog-ng-1.3.13: my logrotate creats immediately after rotation the new log file: ~~~~~~~~~~~ /var/log/ns/f/newfile.log{ daily notifempty create 640 root zzz postrotate /usr/bin/killall -HUP syslog-ng endscript } ~~~~~~~~~~~ When syslog-ng writes in newfile.log, the group changes to "root". Can I specify in the sylog-ng.conf the group-affilation of the destination-file? Apart from this problem syslog-ng works fine! Thanks! wok ~~~ Wolfgang Kössler ZID Universität Innsbruck http://infoA.uibk.ac.at/c102/

2 1

syslog-ng dying on hup - solved
by nija＠magicaldesk.com 01 Nov '00

01 Nov '00

Hello all, I solved the the problem and I thought I would share the solution with everyone. The problem was that by logging using $program, occasionally a $program was blank. Syslog-ng would then try to write the entry to the log file. And since $program was blank, the log file was the current directory! I simply added to the filter 'goodprograms' and all was solved. Below is the full config file. Cheers, Nija # Configuration file for server side syslog-ng ################################################ #################################### # Global options used by syslog-ng #################################### options { time_reopen ( 0 ); sync ( 0 ); chain_hostnames ( no ); use_dns ( yes ); use_fqdn ( yes ); }; ########################################### # Global Source statments for the program ########################################### source src { sun-streams ( "/dev/log" door( "/etc/.syslog_door" )); internal ( ); tcp ( max-connections( 1000 ) ); udp ( ); }; filter goodprograms { not program ("[0-9][0-9]*") or not program (""); }; destination all_messages { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/all-messages" create_dirs ( yes ) dir_perm ( 755 ) perm ( 755 ) );}; destination all_messages2 { pipe ( "/var/adm/nco" );}; destination all_program { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/$PROGRAM" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination all_facility { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/$FACILITY" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination all_priority { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/$PRIORITY" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination all_host { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/messages" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination all_only_program { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/program/$PROGRAM" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination all_only_priority { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/priority/$PRIORITY" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination all_only_facility { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/facility/$FACILITY" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination all_fac_pri { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/facility/$FACILITY.$PRIORITY" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination check_all1 { file ( "/var/log/syslog-ng/all-entries/$HOST" create_dirs ( yes ) );}; destination check_all2 { file ( "/var/log/syslog-ng/all-entries/$HOST.$PROGRAM" );}; destination check_all3 { file ( "/var/log/syslog-ng/all-entries/$HOST.$FACILITY" );}; destination check_all4 { file ( "/var/log/syslog-ng/all-entries/$PROGRAM" );}; destination check_all5 { file ( "/var/log/syslog-ng/all-entries/$FACILITY" );}; log { source( src ); destination( all_messages );}; log { source( src ); destination( all_messages2 );}; log { source( src ); filter ( goodprograms ); destination( all_program );}; log { source( src ); filter ( goodprograms ); destination( all_facility );}; log { source( src ); filter ( goodprograms ); destination( all_priority );}; log { source( src ); destination( all_host );}; log { source( src ); filter ( goodprograms ); destination( all_only_program );}; log { source( src ); filter ( goodprograms ); destination( all_only_priority );}; log { source( src ); filter ( goodprograms ); destination( all_only_facility );}; log { source( src ); filter ( goodprograms ); destination( all_fac_pri );}; log { source( src ); filter ( goodprograms ); destination( check_all1 );}; log { source( src ); filter ( goodprograms ); destination( check_all2 );}; log { source( src ); filter ( goodprograms ); destination( check_all3 );}; log { source( src ); filter ( goodprograms ); destination( check_all4 );}; log { source( src ); filter ( goodprograms ); destination( check_all5 );}; _____________________________________________________________ Global Virtual Desktop Get your free Desktop at http://www.magicaldesk.com

3 2

syslog-ng dying on hup - not solved :(
by nija＠magicaldesk.com 31 Oct '00

31 Oct '00

Hello all, Syslog-ng is still dying on hup. I can not make it consistent. Here is a snipet from syslog-ng's log file. Oct 31 20:41:47 xxx-xxx-xxx-xxx syslog-ng[21918]: syslog-ng version 1.4.7 starting Oct 31 20:42:10 xxx-xxx-xxx-xxx syslog-ng[21918]: SIGHUP received, restarting syslog-ng Oct 31 20:42:24 xxx-xxx-xxx-xxx syslog-ng[21956]: syslog-ng version 1.4.7 starting Oct 31 20:42:29 xxx-xxx-xxx-xxx syslog-ng[21956]: AF_INET client connected from xxx.xxx.xxx.xxx, port 1028 Oct 31 20:43:29 xxx-xxx-xxx-xxx syslog-ng[21956]: SIGHUP received, restarting syslog-ng Oct 31 20:43:29 xxx-xxx-xxx-xxx syslog-ng[21956]: new configuration initialized Oct 31 20:43:38 xxx-xxx-xxx-xxx syslog-ng[21956]: SIGHUP received, restarting syslog-ng Oct 31 20:43:38 xxx-xxx-xxx-xxx syslog-ng[21956]: new configuration initialized Oct 31 20:45:22 xxx-xxx-xxx-xxx syslog-ng[21956]: SIGHUP received, restarting syslog-ng Oct 31 20:45:22 xxx-xxx-xxx-xxx syslog-ng[21956]: new configuration initialized You can see where I have hupped syslog-ng. the SIGHUP shows that. If it is not followed by the message saying 'new cong' initialized then it died. I have tried hupping several ways, manually with -HUP, manually with -1, with a script. About 1 out of every 3 times it dies. I can hup it 10 times in a row with no problems and sometimes it dies every other time. Any help would be greatly appreciated. I did not include my conf file because I have sent it out plenty of times. :) Thank you for the help, Nija _____________________________________________________________ Global Virtual Desktop Get your free Desktop at http://www.magicaldesk.com

1 0

RE: [syslog-ng]/var/adm/messages
by Russell Street 30 Oct '00

30 Oct '00

Sun changed the door in the 5.8 release. On 5.8 there is a symlink from /etc/.syslog_door to /var/run/syslog_door, so the old path will still work. HOWEVER: /var/run is a swap-based file system. It gets re-created from scratch when the OS boots and the door does not exist until the syslog process creates it. If you point syslog-ng at the old place it will fail to create the door in /var/run; it does not create the door at the "end" of the symlink. The syslog client library code in libc is trying to use /var/run/syslog_door and will fail to log messages. It then tends to sleep for 5 seconds after failing to open the door and dumps the messages onto the console. At least that is my experience. Russell -----Original Message----- From: Ohrberg, Mick [mailto:Mick.Ohrberg@umb.com] Sent: Thursday, 26 October 2000 9:56 a.m. To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]/var/adm/messages > I use this source on the 5.6 systems [snip] > sun-streams("/dev/log" door("/etc/.syslog_door") ); [snip] > and this one on 5.8 systems [snip] > sun-streams("/dev/log" door("/var/run/syslog_door") ); What's the difference between these two files? I use /etc/.syslog_door on my 5.8 system. /Mick _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Solaris
by kleyson.rios 27 Oct '00

27 Oct '00

My syslog-ng still continues not to order logs for the archives :( My syslog-ng.conf : options { sync(0); log_fifo_size(10); }; source src { internal(); sun-streams("/dev/log" door("/etc/.syslog_door")); }; __________________________________________________________________________ Todo brasileiro tem direito a um e-mail grátis http://www.bol.com.br

2 1

RE: [syslog-ng]Solaris+match problem
by Hamilton, Andrew Mr. 27 Oct '00

27 Oct '00

I have been busy so it took me a while to test this. Unfortunately I couldn't duplicate your problem. I'm using the same version of syslog-ng and libol that you are. Only difference is I'm running on Solaris 2.7. I will keep trying a few other things. > -----Original Message----- > From: Wendell Turner [SMTP:wt@mail.bytheedge.com] > Sent: Friday, October 27, 2000 8:43 AM > To: 'syslog-ng(a)lists.balabit.hu' > Subject: RE: [syslog-ng]Solaris+match problem > > > Here it is, but it doesn't seem to help a lot. > > open("/export/home/wt/adsi/utils/umon/lin.conf", O_RDONLY) = 3 > brk(0x00039E98) = 0 > brk(0x0003DE98) = 0 > ioctl(3, TCGETA, 0xEFFFEB6C) Err#25 ENOTTY > fstat64(3, 0xEFFFE578) = 0 > brk(0x0003DE98) = 0 > brk(0x0003FE98) = 0 > ioctl(3, TCGETA, 0xEFFFE504) Err#25 ENOTTY > read(3, "\n s o u r c e s r c ".., 8192) = 182 > read(3, 0x0003C7A4, 8192) = 0 > Incurred fault #6, FLTBOUNDS %pc = 0xEF5FB868 > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > Received signal #11, SIGSEGV [caught] > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > sigprocmask(SIG_SETMASK, 0xEF567CE8, 0x00000000) = 0 > sigaction(SIGSEGV, 0xEFFFDE70, 0x00000000) = 0 > setcontext(0xEFFFE030) > Incurred fault #6, FLTBOUNDS %pc = 0xEF5FB868 > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > Received signal #11, SIGSEGV [default] > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > *** process killed *** > > > > Can you do a truss and post the output? That may help. > > > > > However, I'm having trouble running it on Solaris with a config > > > file with a 'match' in it. > > > > > > On my Linux machine, it starts just fine: > > > > > > #uname -a > > > Linux piedmont 2.2.16-3 #6 Sun Oct 22 19:47:27 PDT 2000 i686 > > > > > > # ./syslog-ng --debug --verbose --cfgfile=lin.conf > > > binding fd 3, inetaddr: 0.0.0.0, port: 8514 > > > io.c: Preparing fd 3 for reading > > > syslog-ng version 1.4.7 starting > > > > > > > > > However, that same config file does not run on my Solaris machine: > > > > > > > uname -a > > > SunOS catalina 5.6 Generic_105181-15 sun4u sparc SUNW,Ultra-5_10 > > > > > > > ../src/syslog-ng --debug --verbose --cfgfile=lin.conf > > > Segmentation Fault (core dumped) > > > > > > The config file is: > > > > > > source src { udp( ip("0.0.0.0") port (8514) ); internal(); }; > > > filter f_ftpd { match("ftp"); }; > > > destination cons { file("out.log"); }; > > > log { source(src); destination(cons); }; > > > > > > If I comment out the match filter, syslog-ng on the Solaris machine > > > starts ok. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Solaris+match problem
by Hamilton, Andrew Mr. 27 Oct '00

27 Oct '00

You're right not much help. I run it on Solaris 5.7 and don't have any problems let me do some testing...I will see if I can come up with something if someone else doesn't help you in the meantime... > -----Original Message----- > From: Wendell Turner [SMTP:wt@mail.bytheedge.com] > Sent: Friday, October 27, 2000 8:43 AM > To: 'syslog-ng(a)lists.balabit.hu' > Subject: RE: [syslog-ng]Solaris+match problem > > > Here it is, but it doesn't seem to help a lot. > > open("/export/home/wt/adsi/utils/umon/lin.conf", O_RDONLY) = 3 > brk(0x00039E98) = 0 > brk(0x0003DE98) = 0 > ioctl(3, TCGETA, 0xEFFFEB6C) Err#25 ENOTTY > fstat64(3, 0xEFFFE578) = 0 > brk(0x0003DE98) = 0 > brk(0x0003FE98) = 0 > ioctl(3, TCGETA, 0xEFFFE504) Err#25 ENOTTY > read(3, "\n s o u r c e s r c ".., 8192) = 182 > read(3, 0x0003C7A4, 8192) = 0 > Incurred fault #6, FLTBOUNDS %pc = 0xEF5FB868 > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > Received signal #11, SIGSEGV [caught] > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > sigprocmask(SIG_SETMASK, 0xEF567CE8, 0x00000000) = 0 > sigaction(SIGSEGV, 0xEFFFDE70, 0x00000000) = 0 > setcontext(0xEFFFE030) > Incurred fault #6, FLTBOUNDS %pc = 0xEF5FB868 > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > Received signal #11, SIGSEGV [default] > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > *** process killed *** > > > > Can you do a truss and post the output? That may help. > > > > > However, I'm having trouble running it on Solaris with a config > > > file with a 'match' in it. > > > > > > On my Linux machine, it starts just fine: > > > > > > #uname -a > > > Linux piedmont 2.2.16-3 #6 Sun Oct 22 19:47:27 PDT 2000 i686 > > > > > > # ./syslog-ng --debug --verbose --cfgfile=lin.conf > > > binding fd 3, inetaddr: 0.0.0.0, port: 8514 > > > io.c: Preparing fd 3 for reading > > > syslog-ng version 1.4.7 starting > > > > > > > > > However, that same config file does not run on my Solaris machine: > > > > > > > uname -a > > > SunOS catalina 5.6 Generic_105181-15 sun4u sparc SUNW,Ultra-5_10 > > > > > > > ../src/syslog-ng --debug --verbose --cfgfile=lin.conf > > > Segmentation Fault (core dumped) > > > > > > The config file is: > > > > > > source src { udp( ip("0.0.0.0") port (8514) ); internal(); }; > > > filter f_ftpd { match("ftp"); }; > > > destination cons { file("out.log"); }; > > > log { source(src); destination(cons); }; > > > > > > If I comment out the match filter, syslog-ng on the Solaris machine > > > starts ok. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Solaris+match problem
by Hamilton, Andrew Mr. 27 Oct '00

27 Oct '00

Can you do a truss and post the output? That may help. > -----Original Message----- > From: Wendell Turner [SMTP:wt@mail.bytheedge.com] > Sent: Friday, October 27, 2000 7:30 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Solaris+match problem > > Sirs, > > I have just discovered syslog-ng and it seems to be just what I > was looking for. Thank you, Mr. Scheidler. > > However, I'm having trouble running it on Solaris with a config > file with a 'match' in it. > > On my Linux machine, it starts just fine: > > #uname -a > Linux piedmont 2.2.16-3 #6 Sun Oct 22 19:47:27 PDT 2000 i686 > > # ./syslog-ng --debug --verbose --cfgfile=lin.conf > binding fd 3, inetaddr: 0.0.0.0, port: 8514 > io.c: Preparing fd 3 for reading > syslog-ng version 1.4.7 starting > > > However, that same config file does not run on my Solaris machine: > > > uname -a > SunOS catalina 5.6 Generic_105181-15 sun4u sparc SUNW,Ultra-5_10 > > > ../src/syslog-ng --debug --verbose --cfgfile=lin.conf > Segmentation Fault (core dumped) > > The config file is: > > source src { udp( ip("0.0.0.0") port (8514) ); internal(); }; > filter f_ftpd { match("ftp"); }; > destination cons { file("out.log"); }; > log { source(src); destination(cons); }; > > If I comment out the match filter, syslog-ng on the Solaris machine > starts ok. > > Any suggestions or help? Is there other information I could provide > to help track down the problem? > > Thank you, > > Wendell Turner > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Solaris+match problem
by Wendell Turner 27 Oct '00

27 Oct '00

Sirs, I have just discovered syslog-ng and it seems to be just what I was looking for. Thank you, Mr. Scheidler. However, I'm having trouble running it on Solaris with a config file with a 'match' in it. On my Linux machine, it starts just fine: #uname -a Linux piedmont 2.2.16-3 #6 Sun Oct 22 19:47:27 PDT 2000 i686 # ./syslog-ng --debug --verbose --cfgfile=lin.conf binding fd 3, inetaddr: 0.0.0.0, port: 8514 io.c: Preparing fd 3 for reading syslog-ng version 1.4.7 starting However, that same config file does not run on my Solaris machine: > uname -a SunOS catalina 5.6 Generic_105181-15 sun4u sparc SUNW,Ultra-5_10 > ../src/syslog-ng --debug --verbose --cfgfile=lin.conf Segmentation Fault (core dumped) The config file is: source src { udp( ip("0.0.0.0") port (8514) ); internal(); }; filter f_ftpd { match("ftp"); }; destination cons { file("out.log"); }; log { source(src); destination(cons); }; If I comment out the match filter, syslog-ng on the Solaris machine starts ok. Any suggestions or help? Is there other information I could provide to help track down the problem? Thank you, Wendell Turner

1 0

RE: [syslog-ng]Solaris
by Ohrberg, Mick 26 Oct '00

26 Oct '00

Sounds to me like you've just left out the internal() statement in the source section. /Mick > -----Original Message----- > From: kleyson.rios [mailto:kleyson.rios@bol.com.br] > Sent: Thursday, October 26, 2000 1:19 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Solaris > > > The syslog-ng no this playing the > messages for logs, and the following > message appears when start syslog-ng : > > "Internal messages are not referenced, > they'll go to /dev/null" > > what I must make ? > > My System is Solaris 2.8 Intel > > > ______________________________________________________________ > ____________ > Todo brasileiro tem direito a um e-mail grátis > http://www.bol.com.br > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

Solaris
by kleyson.rios 26 Oct '00

26 Oct '00

The syslog-ng no this playing the messages for logs, and the following message appears when start syslog-ng : "Internal messages are not referenced, they'll go to /dev/null" what I must make ? My System is Solaris 2.8 Intel __________________________________________________________________________ Todo brasileiro tem direito a um e-mail grátis http://www.bol.com.br

1 0

RE: [syslog-ng]/var/adm/messages
by Ohrberg, Mick 25 Oct '00

25 Oct '00

> I use this source on the 5.6 systems [snip] > sun-streams("/dev/log" door("/etc/.syslog_door") ); [snip] > and this one on 5.8 systems [snip] > sun-streams("/dev/log" door("/var/run/syslog_door") ); What's the difference between these two files? I use /etc/.syslog_door on my 5.8 system. /Mick

1 0

RE: [syslog-ng]/var/adm/messages
by Russell Street 25 Oct '00

25 Oct '00

You need to add the syslog door to the source list. I use this source on the 5.6 systems source local { sun-streams("/dev/log" door("/etc/.syslog_door") ); internal(); udp(ip(0.0.0.0) port(514) ); }; and this one on 5.8 systems source local { sun-streams("/dev/log" door("/var/run/syslog_door") ); internal(); udp(); }; The cluster messages go to the local0 facility by default. The switch over messages come out as local0.err. It is a really good idea to replicate the cluster messages to a local file and to the console. If you have a public network failure and the cluster reconfigures the messages will be lost. Russell -----Original Message----- From: Franco Cucchi [mailto:franco.cucchi@db.com] Sent: Thursday, 26 October 2000 5:16 a.m. To: syslog-ng(a)lists.balabit.hu Cc: Manuela Burzoni Subject: [syslog-ng]/var/adm/messages Hi all, I installed the syslog-ng on two SUN machines those are in cluster. The messages generated by the machines those refer to the cluster software are stored in the /var/adm/messages file. In this file it's possible to find the 12 steps sequence of messages generated when the logical host switches from a machine to another due to a failure or a forced takeover. I would like to know if the syslog-ng, with is config file reported below, redirects ALL messages generated (I mean also the log from cluster software) to the machine I use as loghost and not permit the file /var/adm/messages to be written as normal. Any advice or correction welcome. Thanks all Franco # this file show more or less all the features of syslog-ng options { sync(0); time_reopen(10); log_fifo_size(100); }; source direct { sun-stream("/dev/log"); internal();}; source tngsrc { file ("/var/adm/sulog");}; destination loghost { tcp("10.138.xxx.xxx" port (516)); }; destination tngdest { pipe("/usr/tngem/opr/config/dbf1/pipe/oprpipe0009"); }; log { source (direct); destination (loghost); }; log { source (direct); destination (tngdest); }; -- Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet. This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

/var/adm/messages
by Franco Cucchi 25 Oct '00

25 Oct '00

Hi all, I installed the syslog-ng on two SUN machines those are in cluster. The messages generated by the machines those refer to the cluster software are stored in the /var/adm/messages file. In this file it's possible to find the 12 steps sequence of messages generated when the logical host switches from a machine to another due to a failure or a forced takeover. I would like to know if the syslog-ng, with is config file reported below, redirects ALL messages generated (I mean also the log from cluster software) to the machine I use as loghost and not permit the file /var/adm/messages to be written as normal. Any advice or correction welcome. Thanks all Franco # this file show more or less all the features of syslog-ng options { sync(0); time_reopen(10); log_fifo_size(100); }; source direct { sun-stream("/dev/log"); internal();}; source tngsrc { file ("/var/adm/sulog");}; destination loghost { tcp("10.138.xxx.xxx" port (516)); }; destination tngdest { pipe("/usr/tngem/opr/config/dbf1/pipe/oprpipe0009"); }; log { source (direct); destination (loghost); }; log { source (direct); destination (tngdest); }; -- Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet. This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

1 0

Re: [syslog-ng]Buffering to a program.
by John A. Parker 24 Oct '00

24 Oct '00

Mahlon, >My eventual goal is to have one 'logging server', receiving logs from all >of the other servers around here, and parsing/pushing them into a mysql >database. We've implemented basically the same topology here, but instead of "mysql"ing the messages we're parsing and monitoring the lot of them looking for those (repeated login failures within or across system(s), etc..) which might concern us. What we did was write all messages to named pipes, one for each priority level. We made our perl script a daemon which reads the messages out of the named pipes. One of the perceived advantages here was that all buffering is provided by the OS. Our central server (AIX) comfortably supports over 50 disparate clients (AIX, Sun, NT) and handles an average of 310000 messages a day. (We had an anomalous day two weeks ago with 800000 messages with no observed problems.) The only significant disadvantage we've encountered is that our daemon has to be running before syslog-ng is started, this due to syslog-ng rightfully failing to startup if the named pipes are not open, something our daemon does. Good luck, John

1 0

syslog-ng dying on hup
by nija＠magicaldesk.com 23 Oct '00

23 Oct '00

Hello, I am having a small problemm with syslog-ng. About every third time I hup syslog-ng, it dies. I can start it again immediately, but I am curious why it is dying. I have included the conf file. Any ideas? Thank you # Configuration file for server side syslog-ng ################################################ #################################### # Global options used by syslog-ng #################################### options { time_reopen ( 0 ); sync ( 0 ); chain_hostnames ( no ); use_dns ( yes ); use_fqdn ( yes ); }; ########################################### # Global Source statments for the program ########################################### source src { sun-streams( "/dev/log" door( "/etc/.syslog_door" )); internal ( ); tcp ( max-connections(1000) ); udp ( ); }; destination all_messages { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/all-messages" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_messages2 { pipe("/var/adm/nco" );}; destination all_program { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/$PROGRAM" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_facility { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/$FACILITY" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_priority { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/$PRIORITY" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_host { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/messages" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_only_program { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/program/$PROGRAM" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_only_priority { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/priority/$PRIORITY" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_only_facility { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/facility/$FACILITY" create_dirs(yes) perm(755) dir_perm(755) );}; destination all_fac_pri { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/facility/$FACILITY.$PRIORITY" create_dirs(yes) perm(755) dir_perm(755) );}; log { source( src ); destination( all_messages );}; log { source( src ); destination( all_messages2 );}; log { source( src ); destination( all_program );}; log { source( src ); destination( all_facility );}; log { source( src ); destination( all_priority );}; log { source( src ); destination( all_host );}; log { source( src ); destination( all_only_program );}; log { source( src ); destination( all_only_priority );}; log { source( src ); destination( all_only_facility );}; log { source( src ); destination( all_fac_pri );}; _____________________________________________________________ Global Virtual Desktop Get your free Desktop at http://www.magicaldesk.com

1 0