- syslog-ng - lists.balabit.hu

weird problems logging kern.notice with syslog-ng
by Robert Coli 20 Jun '00

20 Jun '00

Hi. I am running the latest syslog-ng under Solaris 2.7 and I'm having problems getting it to do anything with messages of type "kern.notice". Here are the relevant lines in my syslog-ng conf : filter f_auth { facility(auth); }; filter f_kern { facility(kern); }; filter f_notice { level(notice); }; destination messages { file("/var/adm/messages"); }; destination syslog { file("/var/log/syslog"); }; destination authlog { file("/var/log/authlog"); }; destination remote { tcp("xxx.xxx.xxx.xxx" port(514) ); }; # kern.notice /dev/console log { source("system"); filter("f_kern"); filter("f_notice"); destination("console"); destination("messages"); destination("remote"); }; # auth.notice /dev/console log { source("system"); filter("f_auth"); filter("f_notice"); destination("console"); destination("authlog"); destination("messages"); destination("remote"); }; --- Notice that the auth.notice and kern.notice areas are identical, except for the f_kern vs. f_auth filters. -- [happy] /var/adm # logger -p auth.notice AUTH NOTICE TEST #5 [happy] /var/adm # logger -p kern.notice KERN NOTICE TEST #5 [happy] /var/adm # tail messages Jun 8 11:19:32 system@w4 root: AUTH NOTICE TEST #5 -- Anyone have any idea why syslog-ng is picking up auth notice just fine and not picking up kern notice? Thanks! -RC

3 4

Re: klogd on Linux
by klaas.vangend＠philips.com 20 Jun '00

20 Jun '00

Stefan Stammler wrote: > I run syslog-ng 1.4.4, and it works fine except for one thing: the > Linux klogd seems to have problems with it. When both daemons are > running, no kernel messages are logged at all. Stefan, I experience the same thing when running SuSE Linux 6.4 (kernel 2.2.14, gcc 2.95.2) I however didn't have any troubles on Caldera OpenLinux 2.3 (kernel 2.2.10, gcc 2.91.66) I haven't found any solution yet. -- Groetjes, Klaas --------------------------------------------------------------------- Philips CryptoWorks 040-2738472 klaas.vangend(a)philips.com Sioux Technische Software Ontwikkeling BV 040-2677100 klaas.van.gend(a)sioux.nl

1 0

chroot
by Ted Parnefors 19 Jun '00

19 Jun '00

If I'm running some applications in a "chroot"-ed environment, is there any way that I could create a /dev/log socket in the chroot-environment, just like the normal syslog can do? (I'm running on a Linux system) -- Ted Parnefors <ted(a)mtv.se>, KeyID 0x6627DEE4 PGP Fingerprint 1C39FA94703EB54A011CF18932018E256627DEE4

1 0

syslog-ng 1.4.4 and IRIX 6.x
by C. Chan 19 Jun '00

19 Jun '00

Hello, I recently downloaded and built syslog-ng-1.4.4 under IRIX 6.5 without difficulty. I created a syslog-ng.conf similar to my existing syslog.conf. However, none of unix-stream/dgram or sun-streams would work. IRIX uses a a stream /dev/log but apparently it isn't close enough to Sun's. I've seen mention of OSF1 and AIX mentioned in the list archives, but didn't see one re. IRIX in my brief search. Has someone ported syslog-ng to IRIX or has some ideas about where to begin? -- C. Chan < c-chan(a)uchicago.edu > Dept. of Radiology, The University Of Chicago Advanced and High Performance Computing PGP Public Key: finger cchan(a)surya.bsd.uchicago.edu

2 2

AIX Performance
by John A. Parker 19 Jun '00

19 Jun '00

Hi. You've touched on tweaking the gc_idle_threshold, gc_busy_threshold, and log_fifo_size settings to improve syslog-ng performance. I wondered if you might expound upon why altering these has an effect on performance? My central syslog-ng server (handling syslogs for about 30 other systems) is loaded to 50% or more by syslog-ng alone. As our other real time processing of the output from syslog-ng is consuming a comparable amount of system resource, we're going to have to boost the hardware or tune the processes. We don't have "spikes" in logs, just a ton of constant messages. If I understood better what each of the option settings accomplished I think I'd have a better chance of getting the tuning as right as possible. Thanks! John --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

1 0

klogd on Linux
by Stefan Stammler 19 Jun '00

19 Jun '00

I run syslog-ng 1.4.4, and it works fine except for one thing: the Linux klogd seems to have problems with it. When both daemons are running, no kernel messages are logged at all. An strace on klogd shows the following error: connect(1, {sun_family=AF_UNIX, sun_path="/dev/log"}, 10) = -1 EPROTOTYPE (Protocol wrong type for socket) Killing syslog-ng and starting syslogd without touching klogd makes it run fine. What could be the problem? I've read on the list that the starting order of the daemons is important, but I tried all possibilities, always with the same behaviour. My source config: source src { unix-stream( "/dev/log" ); internal(); } ; Stefan

3 2

Destination systax fail ??
by Leonardo Marques de Souza 18 Jun '00

18 Jun '00

Helo, I would like to know what's happen with syslog-ng.conf systax in this part of confiruration: # --------8<------------- # Leitura da porta UDP do syslog padrão (514) # # Por padrão, ele não esta ligado na instalação # Para iniciá-lo, basta descomentar a linha abaixo source net { udp(ip("10.0.2.4") port(514)); }; # --------------------------- # Destino dos dados Filtrados # --------------------------- destination remotenet {udp(ip("10.0.0.10") port(514)); }; <-------(this part have errors ????) destination console { pipe("/dev/console"); }; destination messages { file("/var/log/messages"); }; destination secure { file("/var/log/secure"); }; destination maillog { file("/var/log/maillog"); }; destination spooler { file("/var/log/spooler"); }; destination boot { file("/var/log/boot.log"); }; # -------8<------------------ [root@patolino syslog-ng-1.4.4]# /usr/sbin/syslog-ng -d -v -f /etc/syslog-ng/syslog-ng.conf parse error at 33 Parse error reading configuration file, exiting. [root@patolino syslog-ng-1.4.4]# (line 33 refers to destination remotenet ...) i tryed this syntaxes: **** destination remotenet { udp(ip("10.0.0.10") port(514)); }; destination remotenet { udp(ip(10.0.0.10) port(514)); }; destination remotenet { udp(ip("10.0.0.10") port(514);); }; destination remotenet { udp(ip("10.0.0.10"); port(514)); }; destination remotenet { udp(ip("10.0.0.10"); port(514);); }; destination remotenet { udp(ip("10.0.0.10")); }; destination remotenet { tcp(ip("10.0.0.10") port(514)); }; destination remotenet { udp(ip(10.0.0.10) port(514);); }; destination rtteste { udp(ip("10.0.0.10") port(514)); }; destination remote_net { udp(ip("10.0.0.10") port(514) ); }; ** no sucess.. :( egcs-1.1.2 glibc 2.1.3~ 2.1.2 libol-0.2.17 syslog-ng-1.4.4 kernel-2.2.16 Any one can help me?? who can i increase de Debug?? What i can do to fix that (in source font)? thanks.. PS.: This program have any restriction?? Its realy 100% GPL?? We are thinking to put this program in our distribution here, in Brazil. I built a RPM package, but i trying to a log of tests in our servers (430 servers)... syslog fails to do that :(( lose data, do not restart veri well, use a lot os CPU... :(( i trying syslog-ng to eliminate (or decrese) this problems.. Thank's in advanced!! Leonardo Marques de Souza +--------------------------+ | Conectiva S/A | |Curitiba - Paraná - Brazil| | Suporte Interno | +--------------------------+

4 6

Re: Your sugestion about my problem
by Balazs Scheidler 17 Jun '00

17 Jun '00

> So my intention is very simple, separate log files under firewall events, > this proceedings are necessary to run after special programs to create > security reports, so to do this bellow are my conf files: Case telnet service. > > > > syslog-ng.conf > > options { long_hostnames(off); sync(0); }; > source src { unix-dgram("/dev/log"); internal(); }; > destination messages { file("/var/log/telnet.log"); }; > filter f_telnet { match ("192.168.0.4:23"); }; > log { source(src); filter (f_telnet); destination(messages); }; > > firewall log file > > Packet log: input DENY eth0 PROTO=6 192.168.0.2:1323 192.168.0.4:23 L=48 S=0x00 > I=62731 F=0x4000 T=128 SYN (#1) > Packet log: input DENY eth0 PROTO=6 192.168.0.2:1323 192.168.0.4:23 L=48 S=0x00 > I=62987 F=0x4000 T=128 SYN (#1) > > > I'm running a linux redhat 6.2, ipchains and 2.2.15 kernel version, so I > think right or what do you sugest to resolv this problem because the file > telnet.log is always empty, what wrong. Your klogd is not running. The events above are produced by the kernel, and klogd may not be sending logs. Try to restart it, after you started syslog-ng. -- Bazsi

1 0

Broadcast message on syslog-ng HUP
by Lee Melvin 17 Jun '00

17 Jun '00

I've got syslog-ng 1.4.3 running on a Solaris 2.6 host. When I modify the syslog-ng.conf file and HUP the server, I get an (apparent) empty wall from root: Broadcast message from root (???) on syslog Tue Jun 13 17:00:16... Is this a feature or a bug? Is there any way to mask it? I've tried disabling all lines in the syslog-ng.conf file which output to users or ttys to no avail. Thanks! - Lee

2 1

RE: [syslog-ng] Destination systax fail ??
by Hamilton, Andrew Mr. 17 Jun '00

17 Jun '00

Yes, there is a problem the line should read destination remotenet { udp("10.0.0.10" port(514)); }; The port statement goes inside the parentheses since it is a function of udp for a destination. sources are a little different. Hope this helps. Drew > -----Original Message----- > From: Leonardo Marques de Souza [SMTP:leo@conectiva.com.br] > Sent: Wednesday, June 14, 2000 10:19 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Destination systax fail ?? > > > Helo, > > I would like to know what's happen with syslog-ng.conf systax in this > part of confiruration: > > # --------8<------------- > > # Leitura da porta UDP do syslog padrao (514) > # > # Por padrao, ele nao esta ligado na instalacao > # Para inicia-lo, basta descomentar a linha abaixo > > source net { udp(ip("10.0.2.4") port(514)); }; > > # --------------------------- > # Destino dos dados Filtrados > # --------------------------- > > destination remotenet {udp(ip("10.0.0.10") port(514)); }; <-------(this > part have errors ????) > destination console { pipe("/dev/console"); }; > destination messages { file("/var/log/messages"); }; > destination secure { file("/var/log/secure"); }; > destination maillog { file("/var/log/maillog"); }; > destination spooler { file("/var/log/spooler"); }; > destination boot { file("/var/log/boot.log"); }; > > # -------8<------------------ > > [root@patolino syslog-ng-1.4.4]# /usr/sbin/syslog-ng -d -v -f > /etc/syslog-ng/syslog-ng.conf > parse error at 33 > Parse error reading configuration file, exiting. > [root@patolino syslog-ng-1.4.4]# > > (line 33 refers to destination remotenet ...) > > i tryed this syntaxes: > **** > destination remotenet { udp(ip("10.0.0.10") port(514)); }; > destination remotenet { udp(ip(10.0.0.10) port(514)); }; > destination remotenet { udp(ip("10.0.0.10") port(514);); }; > destination remotenet { udp(ip("10.0.0.10"); port(514)); }; > destination remotenet { udp(ip("10.0.0.10"); port(514);); }; > destination remotenet { udp(ip("10.0.0.10")); }; > destination remotenet { tcp(ip("10.0.0.10") port(514)); }; > destination remotenet { udp(ip(10.0.0.10) port(514);); }; > destination rtteste { udp(ip("10.0.0.10") port(514)); }; > destination remote_net { udp(ip("10.0.0.10") port(514) ); }; > ** > > no sucess.. :( > > egcs-1.1.2 > glibc 2.1.3~ 2.1.2 > libol-0.2.17 > syslog-ng-1.4.4 > kernel-2.2.16 > > > Any one can help me?? > who can i increase de Debug?? What i can do to fix that (in source font)? > thanks.. > > PS.: > > This program have any restriction?? Its realy 100% GPL?? > We are thinking to put this program in our distribution here, in Brazil. > I built a RPM package, but i trying to a log of tests in our servers (430 > servers)... > syslog fails to do that :(( > lose data, do not restart veri well, use a lot os CPU... :(( > > i trying syslog-ng to eliminate (or decrese) this problems.. > > Thank's in advanced!! > > > Leonardo Marques de Souza > +--------------------------+ > | Conectiva S/A | > |Curitiba - Parana - Brazil| > | Suporte Interno | > +--------------------------+ > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2

subscription detail
by rajesh 16 Jun '00

16 Jun '00

1 0

RE: [syslog-ng] Still Having Troubles..
by Mike Novak 08 Jun '00

08 Jun '00

no syslogd is not running on the client -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, June 08, 2000 11:23 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Still Having Troubles.. > i am running syslog-ng on a central log host or try'en to > i am having problums with the client's conf file.. > > <~~~ Client's Conf file ~~~~~> > > source src { unix-dgram("/var/run/log"); udp(); internal(); }; > > destination loghost { tcp("loghost" ip("10.151.94.24") port(1000)); }; > > log { source(src); destination(loghost); }; > > <~~~~~~~~~~~~~~~~~~> > > with this conf, the machine still logs messages in to > /var/log/messages and /var/log/security > > why? > > Any Direction would be dope! isn't the native syslogd running in addition to syslog-ng? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Still Having Troubles..
by Mike Novak 08 Jun '00

08 Jun '00

hey, i am running syslog-ng on a central log host or try'en to i am having problums with the client's conf file.. <~~~ Client's Conf file ~~~~~> source src { unix-dgram("/var/run/log"); udp(); internal(); }; destination loghost { tcp("loghost" ip("10.151.94.24") port(1000)); }; log { source(src); destination(loghost); }; <~~~~~~~~~~~~~~~~~~> with this conf, the machine still logs messages in to /var/log/messages and /var/log/security why? Any Direction would be dope! Novak

2 1

Problems with TCP connection
by Andriy Anokhin 08 Jun '00

08 Jun '00

Hello ! I am running syslog-ng 1.4.4 on Linux RedHat 6.1. I use one syslog-ng server where I collect all syslog messages from 10 systems with syslog-ng connected with TCP. I have problems with reconnection. Syslog-ng on client systems does not reestablish connection with server if connection is broken for long time ( around 2-3 hours). I need only restart syslog-ng daemon on client system. Does anybody have ideas about it ??? Thank you in advance.

2 1

leak problems
by Balazs Scheidler 08 Jun '00

08 Jun '00

Hi, for those experiencing high memory loads on behalf of syslog-ng, please try the attached patch, and check whether memory usage changes. diff -urN syslog-ng-1.4.4/src/affile.c syslog-ng-1.4.5/src/affile.c --- syslog-ng-1.4.4/src/affile.c Fri Jun 2 20:14:02 2000 +++ syslog-ng-1.4.5/src/affile.c Sat Jun 3 12:24:30 2000 @@ -110,12 +110,6 @@ make_log_reader(0, c), NULL); res = REMEMBER_RESOURCE(cfg->resources, &self->src->super.super); -#if 0 - if (self->flags & AFFILE_PIPE) { - self->src->super.close_callback = - make_driver_reinit_on_close(c, res, 0, cfg); - } -#endif return ST_OK | ST_GOON; } else { diff -urN syslog-ng-1.4.4/src/afinet.c syslog-ng-1.4.5/src/afinet.c --- syslog-ng-1.4.4/src/afinet.c Tue Feb 22 18:50:29 2000 +++ syslog-ng-1.4.5/src/afinet.c Sat Jun 3 15:01:10 2000 @@ -242,8 +242,9 @@ self->super.num_connections = 0; { FOR_OBJECT_QUEUE(p, n) { - CAST_SUBTYPE(log_handler, h, n); - append_log_handler(h, self->super.super.super.next); + CAST_SUBTYPE(afsocket_source_connection, h, n); + h->owner = &self->super; + append_log_handler(&h->super, self->super.super.super.next); self->super.num_connections++; } } @@ -392,6 +393,7 @@ struct persistent_config *persistent) { CAST(afinet_dest, self, c); + struct connect_fd *conn_fd; int fd; self->cfg = cfg; @@ -410,11 +412,13 @@ } if (!self->dest_buf) self->dest_buf = make_pkt_buffer(self->super.super.log_fifo_size); - - if (io_connect(cfg->backend, - fd, - self->super.dest_addr, - make_afsocket_dest_connected(cfg->backend, &self->super))) { + conn_fd = io_connect(cfg->backend, + fd, + self->super.dest_addr, + make_afsocket_dest_connected(cfg->backend, &self->super)); + + if (conn_fd) { + REMEMBER_RESOURCE(cfg->resources, &conn_fd->super.super); return ST_OK | ST_GOON; } else { @@ -430,6 +434,10 @@ CAST(afinet_dest, self, c); struct resource_node *n; + if (!self->cfg->living) { + werror("Connection established for an old configuration, dropping...\n"); + return ST_CLOSE | ST_OK; + } if (self->dest) self->dest->buffer = NULL; if (server) { diff -urN syslog-ng-1.4.4/src/afunix.c syslog-ng-1.4.5/src/afunix.c --- syslog-ng-1.4.4/src/afunix.c Tue Feb 22 18:50:29 2000 +++ syslog-ng-1.4.5/src/afunix.c Sat Jun 3 15:01:15 2000 @@ -201,8 +201,9 @@ self->super.num_connections = 0; { FOR_OBJECT_QUEUE(p, n) { - CAST_SUBTYPE(log_handler, h, n); - append_log_handler(h, self->super.super.super.next); + CAST_SUBTYPE(afsocket_source_connection, h, n); + h->owner = &self->super; + append_log_handler(&h->super, self->super.super.super.next); self->super.num_connections++; } } @@ -357,6 +358,8 @@ make_afsocket_dest_connected(cfg->backend, &self->super)); if (conn_fd) { + REMEMBER_RESOURCE(cfg->resources, &conn_fd->super.super); + return ST_OK | ST_GOON; } else { @@ -375,6 +378,10 @@ CAST(afunix_dest, self, c); struct resource_node *n; + if (!self->cfg->living) { + werror("Connection established for an old configuration, dropping...\n"); + return ST_CLOSE | ST_OK; + } if (self->dest) self->dest->buffer = NULL; if (server) { diff -urN syslog-ng-1.4.4/src/cfgfile.c syslog-ng-1.4.5/src/cfgfile.c --- syslog-ng-1.4.4/src/cfgfile.c Fri Mar 10 12:35:26 2000 +++ syslog-ng-1.4.5/src/cfgfile.c Sat Jun 3 14:30:03 2000 @@ -197,6 +197,7 @@ struct log_dest_group *d; struct log_source_group *s; + self->living = 1; for (s = self->sources; s; s = s->next_source_group) { if (s->super.super.destroy) LOG_HANDLER_DESTROY(s, self, persistent); @@ -228,6 +229,7 @@ self->init = do_init_config; self->destroy = do_destroy_config; self->backend = backend; + self->living = 1; self->sync_freq = 0; self->mark_freq = 1200; /* 20 minutes */ self->chain_hostnames = 1; diff -urN syslog-ng-1.4.4/src/cfgfile.h syslog-ng-1.4.5/src/cfgfile.h --- syslog-ng-1.4.4/src/cfgfile.h Fri Mar 24 11:57:28 2000 +++ syslog-ng-1.4.5/src/cfgfile.h Sat Jun 3 14:00:56 2000 @@ -43,6 +43,7 @@ (destroy method int "struct persistent_config *") (resources object resource_list) (backend object io_backend) + (living simple int) ; global options (chain_hostnames simple UINT32) (keep_hostname simple UINT32) diff -urN syslog-ng-1.4.4/src/cfgfile.h.x syslog-ng-1.4.5/src/cfgfile.h.x --- syslog-ng-1.4.4/src/cfgfile.h.x Fri Mar 24 11:59:45 2000 +++ syslog-ng-1.4.5/src/cfgfile.h.x Sat Jun 3 14:04:46 2000 @@ -6,6 +6,7 @@ int (*(destroy))(struct syslog_config *self, struct persistent_config *); struct resource_list *resources; struct io_backend *backend; + int living; UINT32 chain_hostnames; UINT32 keep_hostname; UINT32 mark_freq; diff -urN syslog-ng-1.4.4/src/main.c syslog-ng-1.4.5/src/main.c --- syslog-ng-1.4.4/src/main.c Fri Mar 10 12:35:27 2000 +++ syslog-ng-1.4.5/src/main.c Sat Jun 3 14:29:55 2000 @@ -28,6 +28,7 @@ #include "afinter.h" #include "format.h" #include "werror.h" +#include "queue.h" #include <sys/types.h> #include <sys/wait.h> @@ -84,7 +85,6 @@ self->backend->newconfig = self->backend->oldconfig; self->backend->oldconfig = NULL; io_callout(&self->backend->super, 0, c); - } break; case 3: @@ -150,8 +150,14 @@ break; if (sighuprecvd && !restarting) { + FOR_QUEUE(&backend->super.callouts, struct ol_queue_node *, n) { + ol_queue_remove(n); + ol_space_free(n); + } + notice("SIGHUP received, restarting syslog-ng\n"); restarting = 1; + backend->newconfig = make_syslog_config(cfgfilename, &backend->super); if (backend->newconfig) { static struct reread_config r = -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 1

Syslog-ng Dies - core dump
by John Wingenbach 07 Jun '00

07 Jun '00

I just installed and configured syslog-ng 1.4.3 on a Solaris 2.6 system. It cores out on startup. It apparently doesn't like part of my configuration. Debug output is: #> /opt/syslog-ng/sbin/syslog-ng -d -v binding fd 5, inetaddr: 0.0.0.0, port: 514 io.c: Preparing fd 5 for reading syslog-ng version 1.4.3 starting Segmentation Fault(coredump) My configuration is (Note below the comments regarding code which if removed allows it to live): source s_all { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; # Level Filters filter f_info { level(info .. emerg); }; filter f_warning { level(warning .. emerg); }; filter f_debug { level(debug .. emerg); }; filter f_crit { level(crit .. emerg); }; filter f_err { level(err .. emerg); }; filter f_emerg { level(emerg); }; # Facility Filters filter f_user { facility(user); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon); }; filter f_auth { facility(auth); }; filter f_lpr { facility(lpr); }; filter f_news { facility(news); }; filter f_kern { facility(kern); }; filter f_uucp { facility(uucp); }; filter f_cron { facility(cron); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # Complex Filters filter f_mailerror { filter (f_mail) and filter (f_err); }; filter f_axsyslog { filter (f_info) or filter(f_mailerror); }; ------ It would seem that the following filters used to build a summary syslog cause the problem. ------ filter f_errsanuser { filter (f_err) and not facility(user); }; filter f_kerndebug { filter (f_kern) and filter (f_debug); }; filter f_mailwarning { filter (f_mail) and filter (f_warning); }; filter f_summary { filter (f_errsanuser) or filter (f_kerndebug) or filter (f_daemon) or filter (f_mailwarning); }; destination d_all { file("/var/log/messages"); }; destination d_ttys { usertty("*"); }; destination d_console { file ("/dev/console"); }; destination d_kernfile { file ("/var/log/kern"); }; destination d_syslogfile { file ("/var/log/syslog"); }; destination d_userfile { file ("/var/log/user"); }; destination d_mailfile { file ("/var/log/mail"); }; destination d_mailcritfile { file ("/var/log/mail.crit"); }; destination d_mailwarnfile { file ("/var/log/mail.warning"); }; destination d_daemonfile { file ("/var/log/daemon"); }; destination d_daemonwarningfile { file ("/var/log/daemon.warning"); }; destination d_authfile { file ("/var/log/auth"); }; destination d_lprfile { file ("/var/log/lpr"); }; destination d_newsfile { file ("/var/log/news"); }; destination d_uucpfile { file ("/var/log/uucp"); }; destination d_cronfile { file ("/var/log/cron"); }; destination d_local0file { file ("/var/log/local0"); }; destination d_local1file { file ("/var/log/local1"); }; destination d_local2file { file ("/var/log/local2"); }; destination d_local3file { file ("/var/log/local3"); }; destination d_local4file { file ("/var/log/local4"); }; destination d_local5file { file ("/var/log/local5"); }; destination d_local6file { file ("/var/log/local6"); }; destination d_local7file { file ("/var/log/local7"); }; destination d_axentsyslog { file ("/axent/ita/system/falcon/syslog"); }; destination d_axentmail { file ("/axent/ita/system/falcon/syslog.mdbg"); }; log { source(s_all); filter (f_kern); filter (f_debug); destination (d_kernfile); }; log { source(s_all); filter (f_user); filter (f_debug); destination (d_userfile); }; log { source(s_all); filter (f_mail); filter (f_debug); destination (d_mailfile); }; log { source(s_all); filter (f_mail); filter (f_crit); destination (d_mailcritfile); }; log { source(s_all); filter (f_mail); filter (f_warning); destination (d_mailwarnfile); }; log { source(s_all); filter (f_daemon); filter (f_debug); destination (d_daemonfile); }; log { source(s_all); filter (f_daemon); filter (f_warning); destination (d_daemonwarningfile); }; log { source(s_all); filter (f_auth); filter (f_debug); destination (d_authfile); }; log { source(s_all); filter (f_lpr); filter (f_debug); destination (d_lprfile); }; log { source(s_all); filter (f_news); filter (f_debug); destination (d_newsfile); }; log { source(s_all); filter (f_uucp); filter (f_debug); destination (d_uucpfile); }; log { source(s_all); filter (f_cron); filter (f_debug); destination (d_cronfile); }; log { source(s_all); filter (f_local0); destination (d_local0file); }; log { source(s_all); filter (f_local1); filter (f_debug); destination (d_local1file); }; log { source(s_all); filter (f_local2); destination (d_local2file); }; log { source(s_all); filter (f_local3); destination (d_local3file); }; log { source(s_all); filter (f_local4); filter (f_debug); destination (d_local4file); }; log { source(s_all); filter (f_local5); filter (f_debug); destination (d_local5file); }; log { source(s_all); filter (f_local6); filter (f_debug); destination (d_local6file); }; log { source(s_all); filter (f_local7); filter (f_debug); destination (d_local7file); }; log { source(s_all); filter (f_axsyslog); destination (d_axentsyslog); }; log { source(s_all); filter (f_mail); filter (f_debug); destination (d_axentmail); }; log { source(s_all); filter (f_summary); destination (d_syslogfile); }; -- John C. Wingenbach Pliant Systems, Inc. Sr. Systems Administrator Work: (919) 405-4627 Fax: (919) 405-4544

4 19

bit of an issue with logging
by John 05 Jun '00

05 Jun '00

Hi All, A bit of an issue here. I'm having syslog-ng create directories when a new host starts logging to it, which is all well and good. But, when I look in the servers directory there are some directories with logs in them which surely can't be right! ? ?James ?Oliver ?Rev. "Iona "James "Jane > Jacqueline balloon-kite.co.uk boundary="Boundary-=_pHqghUmeaYlNlfdXfircvsCxgGBw" virgin.net hotmail.com, Is this something I should be worried about? It does worry me!! Any ideas why this is happening? It caused a problem with my newsyslog when it tried to rotate the logs in the > directory causing my disk to get rather full quickly within a few days of not rotating. Cheers, John

2 1

owner and group of create dirs
by Tomohiro Yamauchi 02 Jun '00

02 Jun '00

Hi, My syslog-ng.conf is destination std { file("/var/log/$HOST/$FACILITY.debug/$YEAR$MONTH/$FACILITY.debug$YEAR$MONTH$DAY" owner(admin) group(admin) perm(0600) dir_perm(0700) create_dirs(yes)); }; If /var/log/$HOST/$FACILITY.debug/$YEAR$MONTH is not exist, make that dirs. But that's owner is root:other. I think because daemon's effective user ID is root. I want to change dir's owner. Is this possible? -- Tomohiro Yamauchi handy(a)nid.co.jp

2 3

RE: [syslog-ng] Ignoring previously handled/filtered messages
by Ohrberg, Mick 02 Jun '00

02 Jun '00

IMHO, I WANT the messages to go to several logfiles. For instance, I want a message mail.fatal to go to the fatal logfile as well as the mail logfile. This way I can trigger on messages in the fatal logfile, look in the mail logfile and see if there were any messages in from mail that lead up to the fatal situation. However, when you do the same thing loggin to a remote host, this procedure results in four (!) messages being generated. A better way to handle 'double' messages would be very very nice. : -----Original Message----- : From: John Goggan [mailto:jgoggan@dcg.com] : Sent: Wednesday, May 24, 2000 4:46 PM : To: syslog-ng(a)venus.terrasoft.hu : Subject: Re: [syslog-ng] Ignoring previously handled/filtered messages : : : : ger wrote: : > try : > filter f_daemon { facility(daemon) and not program(name);}; : > : > where "name" is whatever program you're trying to filter out. : : Thanks to Ger and Ilya for their responses. While this does : work, it really : seems like a poor way to do it to me -- and, I believe, is : also quite a bit : different from the way standard syslog handles things. The : problem is that it : should just be easy to make it so that messages are handled : only ONCE and then : not sent to additional logs unless specifically desires. How : many people : really want the same syslog message sent to multiple logs : most of the time? : It just seems that the default (which does this) is the : opposite of what most : would want. : : Plus, what needs to be done to get around this just doesn't : make any sense. : This means that if I want separate logs for imapd, named, : telnetd, and ftpd : (to name just a few common daemons) -- and I want any other : daemons that pop : up to still go to a daemon.log, I have to do this in my : filter section: : : filter f_imapd { program("imapd"); }; : filter f_named { program("named"); }; : filter f_telnetd { program("telnetd"); }; : filter f_ftpd { program("ftpd"); }; : filter f_auth { facility(auth) : and not program("imapd") : and not program("named") : and not program("telnetd") : and not program("ftpd"); }; : filter f_daemon { facility(daemon) : and not program("imapd") : and not program("named") : and not program("telnetd") : and not program("ftpd"); }; : filter f_messages { level(info..warn) : and not facility(auth, authpriv, mail, news); : and not program("imapd") : and not program("named") : and not program("telnetd") : and not program("ftpd"); }; : : That just seems like a really bad design! I have to make : sure that I keep all : of the names updated in several different locations. If I : want to add a log : for just one more daemon, I have to add it to at least 3 : other filters besides : its own filter! : : Aren't other people experiencing such problems? Or is no one : out there using : syslog-ng to filter out specific daemons while still catching : the unlisted : daemons in a daemon.log file? : : There must be a better way... : : - John... : : _______________________________________________ : syslog-ng maillist - syslog-ng(a)lists.balabit.hu : http://lists.balabit.hu/mailman/listinfo/syslog-ng :

5 10

Re: [syslog-ng] ipfw logging
by Ilya 02 Jun '00

02 Jun '00

ok i tried /dev/log - no result, same thing - ipfw is not being logged anywhere. i noiced that i am not the only one with this problem. the other person from japan seems to have similar issue. ---------- Original Message ---------------------------------- From: "Ilya" <maillist(a)krel.org> Reply-To: syslog-ng(a)venus.terrasoft.hu Date: Wed, 31 May 2000 01:36:19 -0400 >I am running on Freebsd 4.0 stable. >i just kept it the way documentation and examples have it and had no problem >except with ipfw

4 4

FW: Newbie...still ty'en
by Mike Novak 01 Jun '00

01 Jun '00

opps sorry did not mean to waste your guys time... Balazs just anwsered my ?..a couple of e-mails ago Thanks Novak > -----Original Message----- > From: Mike Novak > Sent: Thursday, June 01, 2000 10:10 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Newbie...still ty'en > > i have set up syslog-ng on solaris, > and have a stupid ? about destanations > > do i need to create the files in /var/log > > eg.. > > destination security { file("/var/log/security"); }; > > do i need to create the file security... > if so how do i chown it to other? > messages, is owned by other > > > sorry for the trouble i would love any help > Novak

1 0

Newbie...still ty'en
by Mike Novak 01 Jun '00

01 Jun '00

i have set up syslog-ng on solaris, and have a stupid ? about destanations do i need to create the files in /var/log eg.. destination security { file("/var/log/security"); }; do i need to create the file security... if so how do i chown it to other? messages, is owned by other sorry for the trouble i would love any help Novak

1 0

want kernal messages of FreeBSD
by Hideyuki Nishiyama 31 May '00

31 May '00

Hellow. I am H.Nishiyama in japanese. I want syslog-ng to send kernel messages of FreeBSD2.2.8 for ipfw. I tried to use unix-dgram("/de/klog") and file("/dev/klog"). But I didn't successed. Plese tell me how to send kernel messages of FreeBSD2.2.8 for ipfw!! Thank you to ream my letter. ------------------------------------------------------------ 新日本気象海洋株式会社 E-mail:hideyuki@yk.metocean.co.jp 情報システムグループ WWW :http://www.metocean.co.jp/ 西山英之 TEL :045-593-7616 FAX :045-593-7628

2 2

RE: [syslog-ng] ipfw logging
by Hamilton, Andrew Mr. 31 May '00

31 May '00

What are you running on? Your source in src looks a little strange. Most sources are something like /dev/log. What is coming in to /var/run/log? Do you have something putting log messages into a file? Drew > -----Original Message----- > From: maillist [SMTP:maillist@krel.org] > Sent: Tuesday, May 30, 2000 11:21 PM > To: syslog-ng(a)venus.terrasoft.hu > Subject: [syslog-ng] ipfw logging > > hi, ive been trying for two days to log ipfw messages to separate file and > with no success. as soon as i turn on old syslogd with > !ipfw > *.* /var/log/ipfw > it works > but syslog-ng with: > source src { unix-dgram("/var/run/log"); udp(); internal(); } > destination ipfw { file("/var/log/ipfw.log"); }; > filter f_ipfw { program("ipfw"); }; > log { source(src); filter("f_ipfw"); destination("ipfw"); }; > just doesnt catch anything, all the messages from ipfw appear on console, > but not in any file, even not in all.log! > > here is my full config: > # options > options { long_hostnames(off); sync(0); }; > > # sources > source src { unix-dgram("/var/run/log"); udp(); internal(); }; > source src2 { unix-dgram("/var/run/log2"); udp(ip(xxx.xxx.xxx.xxx) > port(514)); }; > > # destinations > destination messages { file("/var/log/messages"); }; > destination security { file("/var/log/security"); }; > destination maillog { file("/var/log/maillog"); }; > destination lpd-errs { file("/var/log/lpd-errs"); }; > destination cron { file("/var/log/cron"); }; > destination all { file("/var/log/all.log"); }; > destination newscrit { file("/var/log/news/news.crit"); }; > destination newserr { file("/var/log/news/news.err"); }; > destination newsnotice { file("/var/log/news/news.notice"); }; > destination slip { file("/var/log/slip.log"); }; > destination ppp { file("/var/log/ppp.log"); }; > destination console { file("/dev/console"); }; > destination root { usertty("root"); }; > destination allusers { usertty("*"); }; > destination rogue { file("/var/log/rogue"); }; > destination cobalt { file("/var/log/cobalt"); }; > destination cisco { file("/var/log/cisco"); }; > destination voyager { file("/var/log/voyager"); }; > destination lists { file("/var/log/lists"); }; > destination lists_m { file("/var/log/lists.sendmail"); }; > destination apollo { file("/var/log/apollo"); }; > destination samson { file("/var/log/samson"); }; > destination samson_d { file("/var/log/samson.bind"); }; > destination bugsy { file("/var/log/bugsy"); }; > #destination loghost { udp("loghost" port(514)); }; > destination goblin { file("/var/log/goblin"); }; > destination allsec { file("/var/log/allsec"); }; > destination samson.named { file("/var/log/named"); }; > destination ipfw { file("/var/log/ipfw.log"); }; > > # log facility filters > filter f_auth { facility(auth); }; > filter f_authpriv { facility(authpriv); }; > filter f_cron { facility(cron); }; > filter f_daemon { facility(daemon); }; > filter f_ftp { facility(ftp); }; > filter f_kern { facility(kern); }; > filter f_lpr { facility(lpr); }; > filter f_mail { facility(mail); }; > filter f_news { facility(news); }; > filter f_security { facility(security); }; > filter f_user { facility(user); }; > filter f_uucp { facility(uucp); }; > filter f_local0 { facility(local0); }; > filter f_local1 { facility(local1); }; > filter f_local2 { facility(local2); }; > filter f_local3 { facility(local3); }; > filter f_local4 { facility(local4); }; > filter f_local5 { facility(local5); }; > filter f_local6 { facility(local6); }; > filter f_local7 { facility(local7); }; > > # log host filters > filter h_rogue { host("rogue"); }; > filter h_cobalt { host("www"); }; > filter h_cisco { host("cisco"); }; > filter h_voyager { host("voyager"); }; > filter h_lists { host("lists"); }; > filter h_apollo { host("apollo"); }; > filter h_samson { host("samson"); }; > filter h_bugsy { host("bugsy"); }; > filter h_goblin { host("goblin"); }; > > # log level filters > filter f_emerg { level(emerg); }; > filter f_alert { level(alert..emerg); }; > filter f_crit { level(crit..emerg); }; > filter f_err { level(err..emerg); }; > filter f_warning { level(warning..emerg); }; > filter f_notice { level(notice..emerg); }; > filter f_info { level(info..emerg); }; > filter f_debug { level(debug..emerg); }; > > # program filters > filter f_ppp { program("ppp"); }; > filter f_slip { program("startslip"); }; > filter f_send { program("sendmail"); }; > filter nf_send { not program("sendmail"); }; > filter f_bind { program("named"); }; > filter nf_bind { not program("named"); }; > filter f_ipfw { program("ipfw"); }; > #filter nf_ipfw { not program("ipfw"); }; > > > > log { source(src2); filter("f_ipfw"); destination("ipfw"); }; > > # *.err;kern.debug;auth.notice;mail.crit /dev/console > log { source(src); filter(f_err); destination(console); }; > log { source(src); filter(f_kern); filter(f_debug); destination(console); > }; > log { source(src); filter(f_auth); filter(f_notice); destination(console); > }; > log { source(src); filter(f_mail); filter(f_crit); destination(console); > }; > > # *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages > log { source(src); filter(f_notice); destination(messages); }; > log { source(src); filter(f_kern); filter(f_debug); destination(messages); > }; > log { source(src); filter(f_lpr); filter(f_info); destination(messages); > }; > log { source(src); filter(f_mail); filter(f_crit); destination(messages); > }; > log { source(src); filter(f_news); filter(f_err); destination(messages); > }; > > # security.* /var/log/security > log { source(src); filter(f_security); destination(security); }; > > # mail.info /var/log/maillog > log { source(src); filter(f_mail); filter(f_info); destination(maillog); > }; > > # lpr.info /var/log/lpd-errs > log { source(src); filter(f_lpr); filter(f_info); destination(lpd-errs); > }; > > # cron.* /var/log/cron > log { source(src); filter(f_cron); destination(cron); }; > > # *.err root > log { source(src); filter(f_err); destination(root); }; > > # *.notice;news.err root > log { source(src); filter(f_notice); destination(root); }; > log { source(src); filter(f_news); filter(f_err); destination(root); }; > > # *.alert root > log { source(src); filter(f_alert); destination(root); }; > > # *.emerg * > log { source(src); filter(f_emerg); destination(allusers); }; > > # uncomment this to enable logging of all log messages to /var/log/all.log > # *.* /var/log/all.log > log { source(src); destination(all); }; > > # uncomment this to enable logging to a remote loghost named loghost > # *.* @loghost > #log { source(src); destination(loghost); }; > > # news.err > /var/log/news/news.err > # news.notice > /var/log/news/news.notice > # > #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); > }; > #log { source(src); filter(f_news); filter(f_err); destination(newserr); > }; > #log { source(src); filter(f_news); filter(f_notice); > destination(newsnotice); }; > > > log { source("src2"); filter("h_rogue"); destination("rogue"); }; > log { source("src2"); filter("h_cobalt"); destination("cobalt"); }; > log { source("src2"); filter("h_cisco"); destination("cisco"); }; > log { source("src2"); filter("h_voyager"); destination("voyager"); }; > log { source("src2"); filter("h_lists"); filter("f_send"); > destination("lists_m"); }; > log { source("src2"); filter("h_lists"); filter("nf_send"); > destination("lists"); }; > log { source("src2"); filter("h_apollo"); destination("apollo"); }; > log { source("src2"); filter("h_samson"); filter("f_bind"); > destination("samson_d"); }; > log { source("src2"); filter("h_samson"); filter("nf_bind"); > destination("samson"); }; > log { source("src2"); filter("h_bugsy"); destination("bugsy"); }; > log { source("src2"); filter("h_goblin"); destination("goblin"); }; > log { source("src2"); filter("f_security"); destination("allsec"); }; > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

ipfw logging
by maillist 30 May '00

30 May '00

hi, ive been trying for two days to log ipfw messages to separate file and with no success. as soon as i turn on old syslogd with !ipfw *.* /var/log/ipfw it works but syslog-ng with: source src { unix-dgram("/var/run/log"); udp(); internal(); } destination ipfw { file("/var/log/ipfw.log"); }; filter f_ipfw { program("ipfw"); }; log { source(src); filter("f_ipfw"); destination("ipfw"); }; just doesnt catch anything, all the messages from ipfw appear on console, but not in any file, even not in all.log! here is my full config: # options options { long_hostnames(off); sync(0); }; # sources source src { unix-dgram("/var/run/log"); udp(); internal(); }; source src2 { unix-dgram("/var/run/log2"); udp(ip(xxx.xxx.xxx.xxx) port(514)); }; # destinations destination messages { file("/var/log/messages"); }; destination security { file("/var/log/security"); }; destination maillog { file("/var/log/maillog"); }; destination lpd-errs { file("/var/log/lpd-errs"); }; destination cron { file("/var/log/cron"); }; destination all { file("/var/log/all.log"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination slip { file("/var/log/slip.log"); }; destination ppp { file("/var/log/ppp.log"); }; destination console { file("/dev/console"); }; destination root { usertty("root"); }; destination allusers { usertty("*"); }; destination rogue { file("/var/log/rogue"); }; destination cobalt { file("/var/log/cobalt"); }; destination cisco { file("/var/log/cisco"); }; destination voyager { file("/var/log/voyager"); }; destination lists { file("/var/log/lists"); }; destination lists_m { file("/var/log/lists.sendmail"); }; destination apollo { file("/var/log/apollo"); }; destination samson { file("/var/log/samson"); }; destination samson_d { file("/var/log/samson.bind"); }; destination bugsy { file("/var/log/bugsy"); }; #destination loghost { udp("loghost" port(514)); }; destination goblin { file("/var/log/goblin"); }; destination allsec { file("/var/log/allsec"); }; destination samson.named { file("/var/log/named"); }; destination ipfw { file("/var/log/ipfw.log"); }; # log facility filters filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # log host filters filter h_rogue { host("rogue"); }; filter h_cobalt { host("www"); }; filter h_cisco { host("cisco"); }; filter h_voyager { host("voyager"); }; filter h_lists { host("lists"); }; filter h_apollo { host("apollo"); }; filter h_samson { host("samson"); }; filter h_bugsy { host("bugsy"); }; filter h_goblin { host("goblin"); }; # log level filters filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info..emerg); }; filter f_debug { level(debug..emerg); }; # program filters filter f_ppp { program("ppp"); }; filter f_slip { program("startslip"); }; filter f_send { program("sendmail"); }; filter nf_send { not program("sendmail"); }; filter f_bind { program("named"); }; filter nf_bind { not program("named"); }; filter f_ipfw { program("ipfw"); }; #filter nf_ipfw { not program("ipfw"); }; log { source(src2); filter("f_ipfw"); destination("ipfw"); }; # *.err;kern.debug;auth.notice;mail.crit /dev/console log { source(src); filter(f_err); destination(console); }; log { source(src); filter(f_kern); filter(f_debug); destination(console); }; log { source(src); filter(f_auth); filter(f_notice); destination(console); }; log { source(src); filter(f_mail); filter(f_crit); destination(console); }; # *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages log { source(src); filter(f_notice); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_lpr); filter(f_info); destination(messages); }; log { source(src); filter(f_mail); filter(f_crit); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # security.* /var/log/security log { source(src); filter(f_security); destination(security); }; # mail.info /var/log/maillog log { source(src); filter(f_mail); filter(f_info); destination(maillog); }; # lpr.info /var/log/lpd-errs log { source(src); filter(f_lpr); filter(f_info); destination(lpd-errs); }; # cron.* /var/log/cron log { source(src); filter(f_cron); destination(cron); }; # *.err root log { source(src); filter(f_err); destination(root); }; # *.notice;news.err root log { source(src); filter(f_notice); destination(root); }; log { source(src); filter(f_news); filter(f_err); destination(root); }; # *.alert root log { source(src); filter(f_alert); destination(root); }; # *.emerg * log { source(src); filter(f_emerg); destination(allusers); }; # uncomment this to enable logging of all log messages to /var/log/all.log # *.* /var/log/all.log log { source(src); destination(all); }; # uncomment this to enable logging to a remote loghost named loghost # *.* @loghost #log { source(src); destination(loghost); }; # news.err /var/log/news/news.err # news.notice /var/log/news/news.notice # #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; #log { source(src); filter(f_news); filter(f_err); destination(newserr); }; #log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source("src2"); filter("h_rogue"); destination("rogue"); }; log { source("src2"); filter("h_cobalt"); destination("cobalt"); }; log { source("src2"); filter("h_cisco"); destination("cisco"); }; log { source("src2"); filter("h_voyager"); destination("voyager"); }; log { source("src2"); filter("h_lists"); filter("f_send"); destination("lists_m"); }; log { source("src2"); filter("h_lists"); filter("nf_send"); destination("lists"); }; log { source("src2"); filter("h_apollo"); destination("apollo"); }; log { source("src2"); filter("h_samson"); filter("f_bind"); destination("samson_d"); }; log { source("src2"); filter("h_samson"); filter("nf_bind"); destination("samson"); }; log { source("src2"); filter("h_bugsy"); destination("bugsy"); }; log { source("src2"); filter("h_goblin"); destination("goblin"); }; log { source("src2"); filter("f_security"); destination("allsec"); };

1 0