- syslog-ng - lists.balabit.hu

Re: [syslog-ng]chain_hostname(yes) complicates use of $HOST variable
by John A. Parker 18 Sep '00

18 Sep '00

On our AIX server, I'm getting a "Parse error reading configuration file, exiting." when I use the keep_hostnames option. This does not happen on our Solaris instance. Any ideas? Thanks! --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

2 4

Re: [syslog-ng]more bugs?
by John A. Parker 15 Sep '00

15 Sep '00

I'm having the same problem detailed by Lawrence with my central AIX syslog-ng server dying when anything happens to a client Sun instance of syslog-ng. In the referenced posting, you mention syslog-ng.1.4.6 and libol.0.2.19 for this problem, but I don't see that version on the http://www.balabit.hu/products/syslog-ng/ page. Should I be looking elsewhere for these packages? Thanks! > The only problem Ive come across (running syslog-ng on 6 servers logging using > tcp to a remote machine). Is that when I kill syslog-ng on my free-bsd machine > the remote machines syslog-ng also dies(linux machine). Not that annoying > though only happens if there is a power cut or I reboot.. try the latest syslog-ng 1.4.6 with libol 0.2.19 --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

3 3

RE: [syslog-ng]chain_hostname(yes) complicates use of $HOST varia ble
by Hamilton, Andrew Mr. 14 Sep '00

14 Sep '00

I use syslog-ng on Solaris 7 but before that I used it on 2.6. I do something very similar to what you are doing in that I log my cisco stuff to local7 as well. I haven't had any problems with it at all. All the cisco stuff goes where it should. I would have to look at the config file to see if there is something wrong there. Your source statement is identical to mine so that seems OK. I don't use chain_hostname() because I don't particularly care where it came through I only want to know where it came from so I use keep_hostname(yes). This keeps only the originating hostname. Hope this helps some. Drew > -----Original Message----- > From: John A. Parker [SMTP:jap54@cornell.edu] > Sent: Thursday, September 14, 2000 12:55 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]chain_hostname(yes) complicates use of $HOST > variable > > Per the extracts from our syslog-ng.conf file shown below, our syslog > server logs messages to machine specific locations based on the sourcing > host name. After turning on the chain_hostnames option, the host name > value in log messages now appear as concatenations of strings. For the > most part they appear similar to: > > aaaa.bbbb.cornell.edu/aaaa.bbbb.cornell.edu > > Messages like the above are still logged correctly. However, we now also > get messages in the formats: > > src@aaaa > > and > > Message/aaaa.bbbb.cornell.edu > last/aaaa.bbbb.cornell.edu > > The first message (src delimited by an ampersand) is logged correctly. > However, the messages prefixed by Message and last are logged to the > directories /logs/machine_specific/Message and > /logs/machine_specific/last. > > Is there a variable other than $HOST I should be using when the > chain_hostnames option is enabled? > > Thanks! > > ########################################################################## > ############# > > options { long_hostnames(off); > use_fqdn(yes); > log_fifo_size(1000); > chain_hostnames(yes); }; > > source src { unix-dgram("/dev/log"); internal(); udp(ip(0.0.0.0) > port(514)); }; > > destination d_all_ms > { > file("/logs/machine_specific/$HOST/all.$LEVEL.$YEAR$MONTH$DAY" > group(systems) perm(0664) dir_perm(0664) create_dirs(yes) > );}; > > # NO CISCO (local7) messages: > filter f_no_cisco { not facility(local7); }; > > # Forward all messages to machine specific log monitored by system admins > log { source(src); > filter(f_no_cisco); > destination(d_all_ms); > }; > > ########################################################################## > ############# > > > > --- > > John A. Parker Senior Programmer/Analyst - AIX Cornell > University > jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

1 0

chain_hostname(yes) complicates use of $HOST variable
by John A. Parker 14 Sep '00

14 Sep '00

Per the extracts from our syslog-ng.conf file shown below, our syslog server logs messages to machine specific locations based on the sourcing host name. After turning on the chain_hostnames option, the host name value in log messages now appear as concatenations of strings. For the most part they appear similar to: aaaa.bbbb.cornell.edu/aaaa.bbbb.cornell.edu Messages like the above are still logged correctly. However, we now also get messages in the formats: src@aaaa and Message/aaaa.bbbb.cornell.edu last/aaaa.bbbb.cornell.edu The first message (src delimited by an ampersand) is logged correctly. However, the messages prefixed by Message and last are logged to the directories /logs/machine_specific/Message and /logs/machine_specific/last. Is there a variable other than $HOST I should be using when the chain_hostnames option is enabled? Thanks! ####################################################################################### options { long_hostnames(off); use_fqdn(yes); log_fifo_size(1000); chain_hostnames(yes); }; source src { unix-dgram("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination d_all_ms { file("/logs/machine_specific/$HOST/all.$LEVEL.$YEAR$MONTH$DAY" group(systems) perm(0664) dir_perm(0664) create_dirs(yes) );}; # NO CISCO (local7) messages: filter f_no_cisco { not facility(local7); }; # Forward all messages to machine specific log monitored by system admins log { source(src); filter(f_no_cisco); destination(d_all_ms); }; ####################################################################################### --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

2 2

Yet another question on filtering
by John A. Parker 13 Sep '00

13 Sep '00

I have yet another filtering question. On an AIX server using the syslog-ng.conf stanzas shown below, the only messages being logged to the d_cisco destination are those I know are coming in under facility local7. However, those same messages are also being logged to the d_all_ms destination which I think I'm filtering out. The filters seems correct and I am successfully using a similar "not" filter elsewhere (for local2 messages). Can anyone explain what I'm doing wrong? Thanks! ####################################################################################### options { long_hostnames(off); use_fqdn(yes); log_fifo_size(1000); chain_hostnames(yes); }; source src { unix-dgram("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination d_all_ms { file("/logs/machine_specific/$HOST/all.$LEVEL.$YEAR$MONTH$DAY" group(systems) perm(0664) dir_perm(0664) create_dirs(yes) );}; destination d_cisco { file("/logs/cisco/cisco.messages" group(systems) perm(0664) );}; # CISCO (local7) messages: filter f_cisco { facility(local7); }; # NO CISCO (local7) messages: filter f_no_cisco { not facility(local7); }; # Forward all messages to machine specific log monitored by system admins log { source(src); filter(f_no_cisco); destination(d_all_ms); }; # Log all messages coming in on local7 facility to /logs/cisco/cisco.messages log { source(src); filter(f_cisco); destination(d_cisco); }; ####################################################################################### --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

1 0

Solaris 2.6 Sources?
by John A. Parker 13 Sep '00

13 Sep '00

I've installed syslog-ng 1.4.5 on a Solaris system and am having trouble "seeing" messages I know are arriving from remote CISCO devices on the local7 facility. (Or even messages via logger -p local7.whatever.) The source statement I have in syslog-ng.conf is: source stdlog { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; (This is as suggested in the INSTALL file provided with the package, except for the addition of the internal clause, the inclusion of which makes no difference in the way syslog-ng is performing.) I have a number of filters, destinations, and log clauses, with some messages "log"ged more than once. (This multiple logging practice seems to work fine on our AIX server.) If I ignore all of the filters and simply log all output to /var/adm/messages, it would appear all messages EXCEPT those coming in on the local7 facility (we're also looking for local0 and local1 messages, but I have not verified any have occurred and that therefore syslog-ng is or is not handling those as well) go to the messages file. Is there something special I should be doing on a Solaris system (a realm WAY outside my experience base) to include local7 logs? Is there a modification to the above source statement that is required for messages from external devices? Thanks! --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

1 0

does not work with klogd
by Torsten Curdt 13 Sep '00

13 Sep '00

I've been using syslogd-ng for quite a while now... like it a lot! Just installed the latest stable version on a new system and now I see a strange behaviour: I installed syslogd-ng. He's logging just fine but then I realized that I don't get any klogd messages!! Not even when klogd comes up! Using the standard syslogd works just fine... Where's the problem? -- Torsten

3 6

Losing Original Information from Forwarded syslog Messages
by John A. Parker 12 Sep '00

12 Sep '00

We are using syslog-ng on an AIX system as the collection point for a large network of IBM, Sun, and "communication device" systems. In addition to logging the received messages, syslog-ng forwards all messages on to named pipes which are monitored by a daemon whose task it is to "real-time" watch for "configurable" activity. (e.g.: "connection refused" messages from a single external system occurring on multiple of our systems, etc.) All of this is working just fine. We have one Sun server which acts as the focus for message from our CISCO routers. That server forwards its messages on to our central syslog-ng server. We now want to watch for failure condition messages from those communication devices, making use of the daemon already in place. What we're faced with though is the stripping of the original source detail when the Sun box's syslogd forwards the message. As example of what we're facing, please see below the source substitution performed by syslogd on the forward. The original message (obviously with a bogus hostname) as logged on the Sun server is: Sep 11 09:42:01 dddd.ddd.ddd.ddd 2939: Sep 11 09:41:59 EDT: %LINK-4-ERROR: FastEthernet0/7 is experiencing errors While that received by syslog-ng in the AIX system is: Sep 11 09:40:57 ssss.sss.sss.sss 2939: Sep 11 09:41:59 EDT: %LINK-4-ERROR: FastEthernet0/7 is experiencing errors My question is this: Is there a way to configure syslogd or syslog-ng so that the entire original message is forwarded? Thanks in advance! John --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

2 1

Re: syslog-ng digest, Vol 1 #250 - 4 msgs
by Jason Tsai 07 Sep '00

07 Sep '00

On Mon, 28 Aug 2000 07:12:48 +0200 syslog-ng-admin(a)lists.balabit.hu wrote: > > 1. Once my linux box receive a log, how can I redirect this log message to someone's > > mail(someone(a)somewhere.com)? > > You could use the program() destination to send messages to a custom script, > which may send an email or anything you want to. > Can you show me how to use the program() in syslog-ng.conf? And how does the program() pass the message to a custom script? using system environment? Thanks. Best Regards Jason Tsai E-Mail: jason(a)leadon.com.tw Tel: +886-2-23949911#815

5 11

RE: [syslog-ng]file to large error
by Hamilton, Andrew Mr. 06 Sep '00

06 Sep '00

Thought I might add that I can get very large files as well. Well in excess of 100 MB. I don't think syslog-ng is limiting the log size. I'm running on a Solaris 2.7 box and I have very few problems with syslog-ng. Drew > -----Original Message----- > From: Nate Campi [SMTP:nate@campin.net] > Sent: Wednesday, September 06, 2000 3:17 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]file to large error > > Just as I'm leaving, I noticed this on my loghost at work (redhat 6.2, UDP > logging for around 50 hosts): > > Sep 5 18:13:04 loghost syslog-ng[24136]: syslog-ng version 1.4.4 starting > Sep 5 18:13:04 loghost syslog: syslog-ng startup succeeded > Sep 5 18:13:04 loghost syslog: klogd startup succeeded > Sep 5 18:13:06 loghost syslog-ng[24136]: io.c: do_write: write() failed > (errno 27), File too large > > Obviously I need to rotate the logs more often on that host, but were you > aware that there is a limit to the file sizes syslog-ng could write to? > > # ls -al /var/log/messages > -rw----r-- 1 root root 9048923 Sep 5 18:15 messages > > Ok, that's a huge logfile, but I just wanted to post that here in case > it's relevant. > > -- > Nate Campi > "If we knew what we were doing, it wouldn't be called research." - > Einstein > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2

RE: [syslog-ng]file to large error
by Shawn Davenport 06 Sep '00

06 Sep '00

Hey folks, Just figured I'd add some info to Nate's problem. I'm running syslog-ng-1.4.5 and libol-0.2.18 under solaris 2.7(sparc). One host collects firewall logs, and I've got several files as large if not larger than the one below. -rw------- 1 root root 112629718 Sep 5 17:23 gc-adminfw_all Not sure if this helps narrow down the problem or not. Thanks... Shawn -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Tuesday, September 05, 2000 6:17 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]file to large error Just as I'm leaving, I noticed this on my loghost at work (redhat 6.2, UDP logging for around 50 hosts): Sep 5 18:13:04 loghost syslog-ng[24136]: syslog-ng version 1.4.4 starting Sep 5 18:13:04 loghost syslog: syslog-ng startup succeeded Sep 5 18:13:04 loghost syslog: klogd startup succeeded Sep 5 18:13:06 loghost syslog-ng[24136]: io.c: do_write: write() failed (errno 27), File too large Obviously I need to rotate the logs more often on that host, but were you aware that there is a limit to the file sizes syslog-ng could write to? # ls -al /var/log/messages -rw----r-- 1 root root 9048923 Sep 5 18:15 messages Ok, that's a huge logfile, but I just wanted to post that here in case it's relevant. -- Nate Campi "If we knew what we were doing, it wouldn't be called research." - Einstein _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Re: syslog-ng digest, Vol 1 #250 - 4 msgs
by Ohrberg, Mick 29 Aug '00

29 Aug '00

2.3.3. program() Selects messages based on the program field. The parameter may be an extended regular expression. Example: program("(sendmail)|(smail)") -----Original Message----- From: Jason Tsai [mailto:jason@nw.leadon.com.tw] Sent: Tuesday, August 29, 2000 12:32 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Re: syslog-ng digest, Vol 1 #250 - 4 msgs On Mon, 28 Aug 2000 07:12:48 +0200 syslog-ng-admin(a)lists.balabit.hu wrote: > > 1. Once my linux box receive a log, how can I redirect this log message to someone's > > mail(someone(a)somewhere.com)? > > You could use the program() destination to send messages to a custom script, > which may send an email or anything you want to. > Can you show me how to use the program() in syslog-ng.conf? And how does the program() pass the message to a custom script? using system environment? Thanks. Best Regards Jason Tsai E-Mail: jason(a)leadon.com.tw Tel: +886-2-23949911#815 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: syslog-ng bug: newlines in messages
by Balazs Scheidler 29 Aug '00

29 Aug '00

> If a syslogged message contains a newline, syslog-ng writes the > message with the newline still embedded. This plays havoc with syslog > parsing. Other syslogd implementations replace the newline with > something else (ie. a space.) bind-8.2.2P5, on startup, logs a > message that contains an embedded newline. The Linux kernel also > occasionally logs messages that contain newlines. I've just comitted a fix, it should be available in the next version, or apply this patch: diff -u -r1.19 log.c --- log.c 2000/03/01 22:02:47 1.19 +++ log.c 2000/08/27 13:39:32 @@ -155,6 +155,9 @@ lm->stamp = now; } + for (oldsrc = src, oldleft = left; oldleft; oldleft--, oldsrc++) { + if (*oldsrc < 32) *oldsrc = '.'; + } lm->msg = c_format_cstring("%s", left, src); } -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

3 2

syslog-ng and syslog
by Rossi Dario 27 Aug '00

27 Aug '00

Hello all, a newbie question.... i have two pcs running linux debian 2.2 System1 is equipped with syslog and Sytem2 with syslog-ng I tried to log the System1 facility daemon on System2 doing so: On System1 (syslog.conf) daemon.* @System2IP On System 2 (syslog-ng.conf) source src { unix-stream("/dev/log"); internal(); udp(); }; destination mydest { file("/var/log/myfile"); }; filter myfilter { facility(daemon) and host("system1"); }; log { source(src); filter(myfilter); destination(mydest); }; options { use-fqdn(yes); }; restarted all daemons and what happened was that daemonlog of system1 was logged on System2-daemonlog instead of System2-myfile. I tried this coexistence with syslog because in a near future i ll have to monitorize some Cis*o logs and i 'd like to do it with syslog-ng, so i need to make it run asap. : O any help? dario

2 1

Filter in syslog-ng
by Jason Tsai 27 Aug '00

27 Aug '00

Hi, I had install syslog-ng on my redhat linux. Can someone tell me.. 1. Once my linux box receive a log, how can I redirect this log message to someone's mail(someone(a)somewhere.com)? 2. Can I filter out some string that I don't want in a single log message line? Best Regards

2 1

ask
by samadi＠linux.ce.sharif.ac.ir 14 Aug '00

14 Aug '00

Hi! I am the computer student. I want to know if I ask question do you answer me? if I have a problem do you solve it me or write it's program? goodlck...

1 0

Re: libol/scsh
by Balazs Scheidler 10 Aug '00

10 Aug '00

> You really should document the fact that libol's class generation stuff > requires scsh for its scripts to run, and syslog-ng uses a libol tool to > rerun on the source files when they change. You might also add a > functioning test to libol configure.in that will fail if scsh is not > present instead of proceeding like it does now. Either and especially > both of these things will save people time ;) scsh is required only to hack on the sources, simply compiling it doesn't require scsh. I may put in some comments though. ... I added this to the README file: Hacking on syslog-ng ==================== Syslog-ng uses a nonblocking I/O, and OO library called libol. Libol uses a preprocessor to generate object definitions and information for the gc to collect garbage. Object definitions are structs and some small functions, and are placed in a file named something.c.x or something.h.x. These .x files are then included in the C source files. This preprocessor is written in Scheme, and requires scsh to run, but is not required to simply compile syslog-ng, since all needed .x files are included in the distribution. If you change a source file though, the .x file needs to be regenerated. By default all generated files are included in the distribution so scsh is only required if you want to change something in the source files. If the change you apply, doesn't change object definitions you don't need to rerun make_class, simply update the date of the .x file using touch: > It might also be a good idea to bundle the OL library with syslog-ng > directly; do you have other programs which use libol ? The reason I > suggest this is because I was really thrown for a loop with the > EINPROGRESS stuff out of connect() that was fixed for .18; I built > syslog-ng with .17 and ended up tracing down the problem with TCP relay > manually only to discover afterwards that it was right in the ChangeLog > for the new libol :) But I did not think libol was involved with respect > to IO in syslog-ng, only with that OO C stuff it seems to be (I can't > tell what it is exactly because there is not any documentation that I > can find). Anyways it might be a good idea to just bundle a stable > libol with syslog-ng and only update that version concurrent with > syslog-ng version upgrades. yes there are other projects that depend on libol (b-wall), though I always suggest distributor maintainers not to create a seperate package. > Now I am not sure about my memory problems, does libol also do > memory allocation for syslog-ng? libol provides the garbage collection framework. syslog-ng uses a mark&sweep garbage collector. libol was forked from lsh's I/O backend, you can read more about its internals in the file /doc/HACKING from the lsh distribution. (ftp://ftp.lysator.liu.se/pub/security/lsh) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: syslog-ng under BSDi
by Balazs Scheidler 10 Aug '00

10 Aug '00

On Wed, Aug 09, 2000 at 04:13:46PM -0400, Rudy Gilson wrote: > > Hello, > > Ive tried compiling v1.4.0 and v1.4.5 under BSDi 4.1. This is the error > during the make. The only version of syslog-ng that will compile is > v1.2.4. Any suggestions?? strptime() is required by syslog-ng. as it seems there are several BSD derivatives which doesn't have it, so I may include a compatibility function in the future. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog-ng death on Debian.
by William Cordis 09 Aug '00

09 Aug '00

I've seen this mentioned several times before in this list but I never saw a fix for it. I'm using libol 0.2.18 and syslog-ng 1.4.5 on a debian woody system doing TCP logging as well as local logging. Syslog will run for many hours just fine and then die like this. --------snip from strace log. opts (-ff -F -i -v -T -x -p 8096 -s 64)------- [400c0574] open("/var/log/heimdall/syslog", O_WRONLY|O_NONBLOCK|O_APPEND|O_CREAT|O_NOCTTY, 0640) = 16 <0.000044> [400c1598] chown("/var/log/heimdall/syslog", 0, 4) = 0 <0.000031> [400c0844] fcntl(16, F_GETFL) = 0xc01 (flags O_WRONLY|O_NONBLOCK|O_APPEND) <0.000019> [400c0844] fcntl(16, F_SETFL, O_WRONLY|O_NONBLOCK|O_APPEND) = 0 <0.000015> [400c0844] fcntl(16, F_SETFD, FD_CLOEXEC) = 0 <0.000015> [400a490d] time(NULL) = 965816705 <0.000017> [400a490d] time(NULL) = 965816705 <0.000015> [400c05ed] close(7) = 0 <0.000106> [400c0674] write(2, "syslog-ng: io.c:172: io_iter: Assertion `i < nfds\' failed.\n", 59) = 59 <0.000038> [4004e8b8] rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 <0.000031> [400ad797] getpid() = 8076 <0.000014> [4004e931] kill(8076, SIGABRT) = 0 <0.000019> [4004e931] --- SIGABRT (Aborted) --- ----------end snip----------------------------------------------------------- The hex in brackets the print instruction pointer at time of syscall. If there's anything I can do to help you diagnose the problem let me know. William Cordis

1 0

FreeBSD
by Sylvain Benoist 08 Aug '00

08 Aug '00

Hi, Is there someone who installed syslog-ng on FreeBSD? I am doind it and have an error message. Indeed, I installed libol 0.2.17 and am installing syslog-ng. > I did $ ./configure in the syslog-ng 1.4.5. directory and it worked. > > Then I did $ make and I have the following error message : > --------------------------------------------------------------------------------------------------------------- > ... > gcc -DHAVE_CONFIG_H -I. -I/home/sbenoist/syslog-ng-1.4.5/src -I. -O2 -Wall > -I/usr/local/include/libol -D_GNU_SOURCE -c syslog-names.c > gcc -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o > center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o > afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o utils.o > syslog-names.o getopt.o getopt1.o -lfl /usr/local/lib/libol.a > log.o: Undefined symbol `_strptime' referenced from text segment > *** Error code 1 > ---------------------------------------------------------------------------------------------------------------- > For earlier versions , I mean 1.2.x, there is no error message. > > So did someone encounter this problem? Thanks, Sylvain

5 8

Re: syslog-ng
by Balazs Scheidler 08 Aug '00

08 Aug '00

> The problem with that is everytime syslog-ng restarts (or HUPd) for whatever > reasons there will be a new instance of the process running. syslog-ng sends a TERM signal IIRC on HUPs, if it doesn't it's a bug. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: syslog-ng
by Balazs Scheidler 08 Aug '00

08 Aug '00

> I have been trying syslog-ng and extremely happy with the power of > using it. I have one question, when using the program option under > destination drivers, my PERL script gets launched when I start syslog-ng, > but executes once and then dies. I am using this script to page any time I > see an log entry, but it only runs the first time it runs. you can read log messages on your stdin, so instead of fetching a single line and exiting keep reading your input like this: #!/usr/bin/perl while (<>) { # send to pager } -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Creating sockets?
by Ted Parnefors 05 Aug '00

05 Aug '00

Is it possible to create sockets with "syslog-ng" similar to how you can do so with "syslogd" ? The reason for this beeing that I'm running some applications chrooted, and need to open a /dev/log socket that is in that chroot-jail.

2 1

Re: Re: [syslog-ng]For loghost application
by Franco Cucchi 03 Aug '00

03 Aug '00

Hi John, thanks very much for your replay! As I told in my previous e-mail I'm trying to use a Linux machine as loghost for IBM AIX and SUN Solaris 7 machines. In the AIX machine I tryed to launch the syslogd with this two examples of syslog.conf files: (See attached file: syslog.conf.txt)(See attached file: syslog.conf) The commad to invoke the syslog daemon is: > nohup /usr/sbin/syslogd -d -f /<path>/syslog.conf but the nohup.out file that contains the response tells me that the syslogd can't resolve " * " as all the priority names and no messages appear in /var/log of the Linux machine. Take a look for example at this row: auth.debug;user.debug;daemon.none @cdslog where the cdslog is the name of the log host and ws2 (in the file syslog.conf) is the name of the IBM machine. If I want to write the messages in a particular file in the log host ( example /var/log/messages) where should I have to specify this path (cause I thik that @cdslog isn't enough and I can't see where messages are written)? If I think at using the syslog-ng, the advantage is great or the syslogd is enough for my applications? Thanks in advance Best Regards Franco *.* @192.168.41.15 # Log all kernel messages to the console. # Logging much else clutters up the screen. #kern.* /dev/console # Log anything (except mail) of level info or higher. #Don't log private authentication messages! *.info;mail.none;authpriv.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log all ssh1 traffic local1.info /var/log/sshdlog # Everybody gets emergency messages, plus log them on another # machine. *.emerg * # Save mail and news errors of level err and higher in a # special file. uucp,news.crit /var/log/spooler

1 0

For loghost application
by Franco Cucchi 03 Aug '00

03 Aug '00

Hi all, I'm very new of this new feature syslog-ng so every advice is welcome! I try to configure the syslog.conf for the syslog daemon running on a IBM AIX platform to write messages on a loghost machine on Linux platform. Every attempt (following lots of advices) failed till now. So, if it's possible to use the syslog-ng to do this I'm going to do this but I would like to take a look at a simple script that shows more or less what should be written to obtain the result that I want. I'm going to take a look at the documentation but I think that could be very helpful to look at some previous working scripts that make a machine to write messages onto another machine. Thanks in advance. Best regards Please reply to franco.cucchi(a)db.com

2 1