- syslog-ng - lists.balabit.hu

remote logging
by dchristman 03 Aug '00

03 Aug '00

Folks - Newbie question.... I am trying to log all messages from a large number ( >50 ) of remote hosts to a central log host. I am using the syntax: destination all { file(/"var/adm/$HOST/messages" create_dirs(yes) ) ;}; I am running solaris 2.7 on SPARC. Please respond directly to dec(a)corp.talkcity.com TIA Dave Christman TALK CITY IT Group dchristman(a)corp.talkcity.com http://www.talkcity.com

2 1

RE: [syslog-ng] (no subject)
by David 03 Aug '00

03 Aug '00

Sorry - It seems that messages from remote hosts are ending up in /var/adm/messages instead of /var/adm/<remote-host>/messages. How to tie the source hostname to the destination filename is the question, I guess. Thanks, Dave --- "Ohrberg, Mick" <Mick.Ohrberg(a)umb.com> wrote: > David, > > What is the question? > > : -----Original Message----- > : From: David [mailto:david_christman@yahoo.com] > : Sent: Wednesday, August 02, 2000 4:23 PM > : To: syslog-ng(a)lists.balabit.hu > : Subject: [syslog-ng] (no subject) > : > : > : Folks - > : > : > : Newbie question.... > : I am trying to log all messages from a large > number ( > : >50 ) of remote hosts to a central log host. I am > : using the syntax: > : > : destination all { file(/"var/adm/$HOST/messages" > : create_dirs(yes) ) ;}; > : > : > : I am running solaris 2.7 on SPARC. > : > : > : TIA > : > : > : ===== > : > : Dave Christman > : Email: david_christman(a)yahoo.com > : > : > : > : __________________________________________________ > : Do You Yahoo!? > : Kick off your party with Yahoo! Invites. > : http://invites.yahoo.com/ > : > : _______________________________________________ > : syslog-ng maillist - syslog-ng(a)lists.balabit.hu > : http://lists.balabit.hu/mailman/listinfo/syslog-ng > : > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng ===== Dave Christman Email: david_christman(a)yahoo.com __________________________________________________ Do You Yahoo!? Kick off your party with Yahoo! Invites. http://invites.yahoo.com/

2 2

RE: [syslog-ng] (no subject)
by Ohrberg, Mick 02 Aug '00

02 Aug '00

David, What is the question? : -----Original Message----- : From: David [mailto:david_christman@yahoo.com] : Sent: Wednesday, August 02, 2000 4:23 PM : To: syslog-ng(a)lists.balabit.hu : Subject: [syslog-ng] (no subject) : : : Folks - : : : Newbie question.... : I am trying to log all messages from a large number ( : >50 ) of remote hosts to a central log host. I am : using the syntax: : : destination all { file(/"var/adm/$HOST/messages" : create_dirs(yes) ) ;}; : : : I am running solaris 2.7 on SPARC. : : : TIA : : : ===== : : Dave Christman : Email: david_christman(a)yahoo.com : : : : __________________________________________________ : Do You Yahoo!? : Kick off your party with Yahoo! Invites. : http://invites.yahoo.com/ : : _______________________________________________ : syslog-ng maillist - syslog-ng(a)lists.balabit.hu : http://lists.balabit.hu/mailman/listinfo/syslog-ng :

1 0

(no subject)
by David 02 Aug '00

02 Aug '00

Folks - Newbie question.... I am trying to log all messages from a large number ( >50 ) of remote hosts to a central log host. I am using the syntax: destination all { file(/"var/adm/$HOST/messages" create_dirs(yes) ) ;}; I am running solaris 2.7 on SPARC. TIA ===== Dave Christman Email: david_christman(a)yahoo.com __________________________________________________ Do You Yahoo!? Kick off your party with Yahoo! Invites. http://invites.yahoo.com/

1 0

Extension for syslog-ng
by Martin Neimeier 02 Aug '00

02 Aug '00

Hello, for me, there are some features missing: 1. Real boolean expresions in filter statements with: and, or, not , (, ) filter test { ( ( program("abc") or program("cde") ) and level("info") ) or ( program("xyz") and level("debug") ); }; 2. What about actions ? Actions can be used to modify the contents of an log-message (sed-like) befor writing it to its destination. 3. new destination database Is something planed ? Is it interesting ? cu MN -- -------------- Martin Neimeier Tel:+49(6262)912344 Fax:+49(6262)912347

2 1

Unsresolved reference
by Nicholas Brawn 02 Aug '00

02 Aug '00

Using syslog-ng 1.4.4: [root@utumno /etc]# /usr/local/sbin/syslog-ng -d -f /etc/syslog-ng.conf io.c: Preparing fd 3 for reading io.c: listening on fd 4 Warning: Internal messages are not referenced, they'll go to /dev/null unresolved reference: f_ruby Error initializing configuration, exiting. This is the filter it is talking about: filter f_ruby { host(ruby.domain.com); }; Cheers, Nick -- Secure email preferred. PGP key available on request. Phone: +61 2 9025 7571 || Email: nickbrawn(a)onetel.com

2 1

RE: [syslog-ng] Unsresolved reference
by Hamilton, Andrew Mr. 02 Aug '00

02 Aug '00

Try: filter f_ruby { host("ruby.domain.com"); }; Regards, Drew > -----Original Message----- > From: Nicholas Brawn [SMTP:nickbrawn@onetel.com] > Sent: Wednesday, August 02, 2000 2:19 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Unsresolved reference > > Using syslog-ng 1.4.4: > > [root@utumno /etc]# /usr/local/sbin/syslog-ng -d -f /etc/syslog-ng.conf > io.c: Preparing fd 3 for reading > io.c: listening on fd 4 > Warning: Internal messages are not referenced, they'll go to /dev/null > unresolved reference: f_ruby > Error initializing configuration, exiting. > > This is the filter it is talking about: > > filter f_ruby { host(ruby.domain.com); }; > > Cheers, > Nick > > > > -- > Secure email preferred. PGP key available on request. > Phone: +61 2 9025 7571 || Email: nickbrawn(a)onetel.com > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Printing of Priority in the Log files
by Jonathan Gilpin 28 Jul '00

28 Jul '00

Hi, Is is possible to make syslog-ng print the priority level to the log files? --- { xpedio - where mobile means anywhere, anytime, on anything (almost) } Jonathan Gilpin, +46(0) 733 44 10 09

2 1

Log directory
by Nicholas Brawn 17 Jul '00

17 Jul '00

Is there an 'option' to specify a defined "log directory" instead of having to specify the full path to a log file? I am using syslog-ng 1.4.4. Cheers, Nick -- Secure email preferred. PGP key available on request. Phone: +61 2 9025 7571 || Email: nickbrawn(a)onetel.com

2 1

syslog-ng 1.4.5
by Balazs Scheidler 15 Jul '00

15 Jul '00

Hi, For those who have not noticed I silently released syslog-ng 1.4.5, hopefully getting rid of the memory leak some of you encountered. So if you had a syslog-ng process using >10M RAM, you should upgrade your syslog-ng. (The problem was caused by network destinations) There's still one thing to fix, but I don't think that would be too annoying: while : ; do killall -HUP syslog-ng; done This still results in some leaks, but while : ; do killall -HUP syslog-ng; sleep 1; done doesn't. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

RE: [syslog-ng] Problems with syslog-ng use over a redireted port inside an SSH s ession
by Edwards, David 10 Jul '00

10 Jul '00

Hi, > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Subject: Re: [syslog-ng] Problems with syslog-ng use over a redireted > port inside an SSH s ession > > > > > I'm using syslog-ng over redirected ports inside an SSH > > > > channel and whenever I HUP syslog-ng, the SSH channel > > > > closes > > > > > > Maybe you should try to handle the SIGPIPE signal in your > perl script? > > > though SIGPIPE should occur only on output, reading from a > > > broken socket > > > should result in an EPIPE to be returned. From what I can tell, the channel drops when the child process writing to it exits. I can trap the SIGPIPE and the channel stays up but as soon as the child closes the socket and exits, the channel drops. I think the script needs a re-think :-) > syslog-ng closes TCP connections when a SIGHUP is received, > but you can > change this behaviour with the keep-alive option. > > destination all { tcp("loghost" port(1514) keep-alive(yes)); }; Thanks, this works a treat! RTFM eh.. I've used it in the source rules however. tcp(ip("127.0.0.12") port(51400) keep-alive(yes)); The script _sends_ logs to a remote syslog-ng loghost which listens on a localhost port redirected over the ssh channel. I'm sure the problem is in the script now so I'll leave you folks alone. Looks like it's back to the drawing board again. Thanks for the help! ciao dave ---- Dave Edwards mailto:david.edwards@eds.com Ph: +61 8 83015720 EDS Network Support Glenside, South Australia ---- PGP Fingerprint: B9C0 AB83 F18B CE88 C167 67B9 6AB2 C630 3DC9 ACC2

1 0

RE: [syslog-ng] Problems with syslog-ng use over a redireted port inside an SSH s ession
by Edwards, David 10 Jul '00

10 Jul '00

Hi > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Subject: Re: [syslog-ng] Problems with syslog-ng use over a redireted > port inside an SSH s ession > > > I'm using syslog-ng over redirected ports inside an SSH > > channel and whenever I HUP syslog-ng, the SSH channel > > closes > > Maybe you should try to handle the SIGPIPE signal in your perl script? > though SIGPIPE should occur only on output, reading from a > broken socket > should result in an EPIPE to be returned. Well that's what I would have thought, the child process _is_ writing the socket but does not recieve any such signal (or appears not to..) The child lives on and when it next writes the socket, the channel drops and then it dies. Netcat dies imediately when syslog-ng is HUPPED, which points again at the script of course.. I'll capture the ssh (openssh 2.1) debug output and I can post the key bits of the script if you think it would help? And I'll add a trap for SIGPIPE. Thanks for the responce. ciao dave ---- Dave Edwards mailto:david.edwards@eds.com Ph: +61 8 83015720 EDS Network Support Glenside, South Australia ---- PGP Fingerprint: B9C0 AB83 F18B CE88 C167 67B9 6AB2 C630 3DC9 ACC2

2 1

Problems with syslog-ng use over a redireted port inside an SSH s ession
by Edwards, David 10 Jul '00

10 Jul '00

Hi, I'm using syslog-ng over redirected ports inside an SSH channel and whenever I HUP syslog-ng, the SSH channel closes. This appears to be a problem with syslog-ng, as if I kill -KILL syslog-ng, the channel remains in place. I copy logs over the channel using a perl script. This also may be suspect of course.. The channel seems to close when the script writes to the (possibly disrupted tcp) socket. If I don't write to the socket, the channel stays up.. I use the IO::Socket method $socket->can_write to attempt to find out if the socket is still writable but this does not show any problems but the channel dies anyway. Anyone else seeing this problem? ciao dave ---- Dave Edwards mailto:david.edwards@eds.com Ph: +61 8 83015720 EDS Network Support Glenside, South Australia ---- PGP Fingerprint: B9C0 AB83 F18B CE88 C167 67B9 6AB2 C630 3DC9 ACC2

2 1

Multiple criteria per filter and hostnames?
by Nicholas Brawn 10 Jul '00

10 Jul '00

I have been testing both nsyslog and syslog-ng recently (after discovering syslog-ng is based on nsyslog). One thing I have noticed while testing syslog-ng 1.4.4, is that it doesn't appear to allow filters such as: filter myfilter { facility(auth); host(system); }; which were valid in nsyslog. In addition, nsyslog appeared to support reverse lookups of the source ip, to resolve into fqdn. So a message received by nsyslog from host "blah1" would appear in logs as "blah1.mydomain.com". Whereas in syslog-ng it would appear as "blah1" OR with the long_hostnames(yes) option, would log the hostname as "blah1/blah1". Questions: 1. Is it possible to specify multiple criteria per filter? 2. Is it possible to enable reverse lookups and log hostname in fqdn? Cheers, Nick -- GPG/PGP key available on request.

2 1

Re: syslog-ng memory leak patch
by Balazs Scheidler 07 Jul '00

07 Jul '00

On Mon, Jun 26, 2000 at 08:42:34AM -0400, Scott McDermott wrote: > I noticed your post on the syslog-ng archives concerning memory leaks in > the software. I was wondering if you had met any success reports with > this patch. I just discovered my DMZ loghost has a 70MB syslog-ng image > in core after running only a couple of weeks; there is most *definitely* > a memory leak. I was going to track it down myself, but thought I would > check the list archives first...indeed, your patch was posted. > > Before I implement the patch, I was wondering if you've had success > running some syslog-ngs for more than a week, with at least half a dozen > hosts logging to it, and kept the memory image within reasonable limits, > with this patch. If it's not a complete leak preventer, I'd just as > soon do a full audit of the source, since I simply must use syslog-ng in > production. Either that, or we could split the work or something... That patch fixed some leak bugs, but as it seems not all of them. I'm now trying to reproduce the problem. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

RPM spec file?
by Chris Geddings 29 Jun '00

29 Jun '00

Would anyone have any spec files to build an rpm for syslog-ng? Thanks, Chris

2 1

RE: [syslog-ng] RPM spec file?
by Ohrberg, Mick 29 Jun '00

29 Jun '00

...and has anyone thought about building a Solaris pkg? :) : -----Original Message----- : From: Chris Geddings [mailto:cegeddin@colltech.com] : Sent: Thursday, June 29, 2000 9:53 AM : To: syslog-ng(a)lists.balabit.hu : Subject: [syslog-ng] RPM spec file? : : : Would anyone have any spec files to build an rpm for syslog-ng? : : Thanks, : Chris : : _______________________________________________ : syslog-ng maillist - syslog-ng(a)lists.balabit.hu : http://lists.balabit.hu/mailman/listinfo/syslog-ng :

1 0

logging via tcp connection
by will＠korson-mcgregor.com 29 Jun '00

29 Jun '00

I'm trying to set up a Linux Firewall to log to a central log box. Both are running syslog-ng 1.4.4 on Debian 2.2. -----------snip from logbox syslog-ng.conf-------- source firewall { tcp(ip(0.0.0.0) port(1999)); }; -----------end snip from logbox syslog-ng.conf---- syslog-ng starts just fine with no errors. # netstat -an |grep 1999 tcp 0 0 0.0.0.0:1999 0.0.0.0:* LISTEN Seems to be up and running fine. -----------snip from firewall syslog-ng.conf--------- destination logbox { tcp("10.0.0.87" port(1999)); }; -----------snip from firewall syslog-ng.conf--------- # syslog-ng -d -v binding fd 3, unixaddr: /dev/log io.c: listening on fd 3 io.c: connecting using fd 4 connecting fd 4 to inetaddr 10.0.0.87, port 1999 Error creating AF_INET socket (Operation now in progress) Error initializing configuration, exiting. Thats not good # strace -s 64 -f -F -vv syslog-ng -d -v --snip---- socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 4 fcntl(4, F_GETFL) = 0x2 (flags O_RDWR) fcntl(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 fcntl(4, F_SETFD, FD_CLOEXEC) = 0 write(2, "io.c: connecting using fd 4\n", 28io.c: connecting using fd 4) = 28 write(2, "connecting fd 4 to inetaddr 10.0.0.87, port 1999\n", 49connecting fd 4 to inetaddr 10.0.0.87, port 1999) = 49 connect(4, {sin_family=AF_INET, sin_port=htons(1999), sin_addr=inet_addr("10.0.0.87")}}, 16) = -1 EINPROGRESS (Operation now in progress) close(4) = 0 write(2, "Error creating AF_INET socket (Operation now in progress)\n", 58Error creating AF_INET socket (Operation now in progress)) = 58 write(2, "Error initializing configuration, exiting.\n", 43Error initializing configuration, exiting.) = 43 _exit(2) = ? Even worse.. it seems that the connection is not even given time to connect successfully but is closed immediatly. I'm not a good socket hacker or I'd try to fix it myself. Is it possible that I have some config value wrong or am using a known buggy version? Help would be most appreciated! Will Cordis

3 2

massive memory leak
by Scott McDermott 28 Jun '00

28 Jun '00

I was wondering if anyone else has had the experience of checking out processes on their DMZ log forwarder after a couple of weeks of running syslog-ng (~5 machines logging to it, one file destination, one TCP remote), only to find its VSZ to be approaching 80MB :) Obviously some kind of significant memory leak. According to the list archives, another poster put up a patch but he has not responded to my inquiries; I'm wondering if anyone else has patches or has used the patch posted not too long ago...or at least, perhaps someone could confirm that they also must restart the syslog-ng process daily to combat memory leakage.

3 5

junk with syslog-ng 1.4.4 on HP-UX 10.20
by Massimo Loschi 28 Jun '00

28 Jun '00

Hi! I'm using syslog-ng 1.4.4 on HP-UX 10.20 host, with a file as destination, and source log device source slocal { pipe("/dev/log"); internal(); }; (I haven't the /dev/log.un UNIX domain socket, and I don't know how create it!) It appears that the kernel send to /dev/log additional binary data with each real log messages: for example: head junk.log | od -c 0000000 J u n 2 7 1 3 : 0 5 : 0 5 0000020 s e b b e n e { \n J u n 2 7 0000040 1 3 : 0 5 : 0 5 s e b b e n 0000060 e 270 \n J u n 2 7 1 3 : 0 5 0000100 : 0 5 s e b b e n e { \n J u 0000120 n 2 7 1 3 : 0 5 : 0 5 s e 0000140 b b e n e 270 \n J u n 2 7 1 0000160 3 : 0 5 : 0 5 s e b b e n e 0000200 300 \t 367 [ 300 \t 240 203 \n J u n 2 7 0000220 1 3 : 0 5 : 0 5 s e b b e n e 0000240 { 001 P ( { 003 267 350 \n J u n 2 7 0000260 1 3 : 0 5 : 0 5 s e b b e n 0000300 e 001 { 003 265 330 300 005 f , @ \n J u n 0000320 2 7 1 3 : 0 5 : 0 5 s e b 0000340 b e n e 4 250 \n J u n 2 7 1 0000360 3 : 0 5 : 0 5 s e b b e n e 0000400 { \n J u n 2 7 1 3 : 0 5 : 0 0000420 5 s e b b e n e 270 \n I read in the list that there is already a workaround support for a very similar problem on HP-UX, but it appears not to works for my problem. Does someone encountered and resolved this problem?!? Thanks in advance! Massimmo ------------------------------------------------------------------------------ Massimo Loschi E-mail: m.loschi(a)nextra.it Network & Core Systems NEXTRA S.p.A. WWW: http://www.nextra.it Via Isonzo, 55/2 Tel: +39 51 6139211 40033 Casalecchio di Reno Fax: +39 51 6114455 Bologna - ITALY ------------------------------------------------------------------------------

1 0

RE: [syslog-ng] Program Directive (EOF?)
by Ohrberg, Mick 28 Jun '00

28 Jun '00

Ithas been addressed earlier. What you need to do is write a 'wrapper' script that reads from stdin and appends its own EOF. That way you will get the Ctrl-D that syslog doesn't give you. : -----Original Message----- : From: Don Armstrong [mailto:don@donarmstrong.com] : Sent: Sunday, June 25, 2000 5:02 PM : To: syslog-ng(a)lists.balabit.hu : Subject: [syslog-ng] Program Directive (EOF?) : : : Is there any way that we could add a feature to the program directive : to have it send an EOF after a specified number of messages? Or : something similar? : : I'm trying to set up qpage to page me when certain messages are : logged, but because there is no EOF sent (I think that's correct) the : qpage just sits there waiting for the message to end. [Same thing : with sendmail]. : : I guess I could just bite the bullet an write an go-between parser to : do it, but it seems that this sort of functionality would be good for : syslog-ng to have. : : Don Armstrong : : [I apologize if this has been addressed earlier... non-searchable : archives are difficult to glean answers from ;-)] : : -------------------------------------------------------------- : Don Armstrong | ".naidnE elttiL etaH I" : UC Riverside | : don(a)donarmstrong.com | http://www.donarmstrong.com : -------------------------------------------------------------- : do "finger -l don(a)pellam.ucr.edu" for pgp key : Unsigned, Unencrypted e-mails will not be trusted. : Get PGP: http://www.pgp.com : -------------------------------------------------------------- : : : _______________________________________________ : syslog-ng maillist - syslog-ng(a)lists.balabit.hu : http://lists.balabit.hu/mailman/listinfo/syslog-ng :

2 1

Program Directive (EOF?)
by Don Armstrong 26 Jun '00

26 Jun '00

Is there any way that we could add a feature to the program directive to have it send an EOF after a specified number of messages? Or something similar? I'm trying to set up qpage to page me when certain messages are logged, but because there is no EOF sent (I think that's correct) the qpage just sits there waiting for the message to end. [Same thing with sendmail]. I guess I could just bite the bullet an write an go-between parser to do it, but it seems that this sort of functionality would be good for syslog-ng to have. Don Armstrong [I apologize if this has been addressed earlier... non-searchable archives are difficult to glean answers from ;-)] -------------------------------------------------------------- Don Armstrong | ".naidnE elttiL etaH I" UC Riverside | don(a)donarmstrong.com | http://www.donarmstrong.com -------------------------------------------------------------- do "finger -l don(a)pellam.ucr.edu" for pgp key Unsigned, Unencrypted e-mails will not be trusted. Get PGP: http://www.pgp.com --------------------------------------------------------------

1 0

Syslog NG version 1.42 not allowing remote hosts to log
by Thomas Munn 20 Jun '00

20 Jun '00

All: I have configured and installed syslog-ng version 1.42. It is logging fine for localhost, but it doesn't accept remote connections. I am attaching my syslog-ng.conf. Basically a re-write of the sample config file, with a couple of host entries. I can use normal syslog to log to the host. (E.G. the packets are arriving on port 514, udp). # # Syslog-ng example configuration for for Debian GNU/Linux # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # options { long_hostnames(off); sync(0); }; source src { unix-stream("/dev/log"); internal(); }; source net { udp(ip(0.0.0.0) port(514)); }; # kern facility OK destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination mail { file("/var/log/mail.log"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; destination host1 { file ("/var/log/ns2"); }; #destination loghost { udp("loghost" port(999)); }; destination xconsole { pipe("/dev/xconsole"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_host1 { host("192.22.2.250"); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source (src); filter (f_host1); destination (host1); }; log { source(src); destination(console_all); };

1 0

Re: Error creating AF_INET socket (Operation now in progress)
by nasrot＠secondwave.cz 20 Jun '00

20 Jun '00

Hi, I'm running syslog-ng-1.4.4 and I'm having problems with logging via TCP ( udp works fine ), everything looks good on the syslog-ng server ... interesting part of the config looks like this : ... source nettcp { tcp(ip("10.1.1.10") port(1999)); }; ... it makes the loghost listening on the port ... I can tellnet to it and syslog-ng logs everything I write to terminal as well and I get very positiv message also ... Jun 19 13:59:44 budha syslog-ng[32469]: AF_INET client connected from 10.1.1.7, port 3024 Jun 19 13:59:44 budha tcplogd: port 1999 connection attempt from [10.1.1.7] .... but running syslog-ng on another host with .... destination everything { tcp("10.1.1.10" port(1999)); }; ... results in gate:~# syslog-ng -d io.c: listening on fd 3 io.c: listening on fd 4 io.c: connecting using fd 5 Error creating AF_INET socket (Operation now in progress) Error initializing configuration, exiting. gate:~# this appears in the server logs Jun 19 18:35:19 budha tcplogd: port 1999 connection attempt from [10.1.1.7] anybody knows where the problem resides ? pleas tell me thanx

1 0

syslog-ng on Solaris 2.4 Sparc
by Andrew A. Razdolsky 20 Jun '00

20 Jun '00

Hi all! I'v just installed syslog-ng v.1.4.4 and for now can't make it to work. First, i can't write test log to it from localhost only it listen for remote connections. Second, i can't compile "match" statements, error occur like this: 'Error compiling regular expression: "match" () Parse error reading configuration file, exiting.' I can't solve this. Any help will by appreciated! P.S. I make configure with '--enable-sun-streams' setting. - Best Regards, Andrew A. Razdoslky NSC KIPT Network Operation Center

1 0