- syslog-ng - lists.balabit.hu

Re: [syslog-ng] supervisor not restarting a failed daemon process
by Balazs Scheidler 29 Apr '13

29 Apr '13

Strange, indeed. The supervisor gives up if the restarted daemon exits for some reason. Eg. If there's an initialization error it gives up. Any indication in the logs? Evan Rempel <erempel(a)uvic.ca> wrote: >We are sing the log line > >supervise/syslog-ng[27221]: Daemon exited due to a deadlock/signal/failure, restarting; exitcode='11' > > >and it looks like it should restart, but instead of restarting, >the supervisor terminates and then no syslog-ng process is running. > >Is this a bug in the supervisor? >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq >

2 1

Can not get DBParse match macro result (syslog-ng 3.13 debian squeeze)
by 不坏阿峰 27 Apr '13

27 Apr '13

when use pdbtool do match test, it is success. but from syslog-ng can not return result of macro i can not get macro result. for example, ${.esxi.month} no value, same as ${.esxi.host_ip} ${.esxi.time} test log output ,just like this. === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , do the pdbtool test, it's ok. wish someone can give me some solution and help. i have search some mail list but i can not get the right solution. thanks a lot. root@debian:~# pdbtool match -D -c -p /etc/syslog-ng/patterndb/esxi_pattern.xml -P ESXI -M "Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev "mpx.vmhba0:C0:T0:L0" on path "vmhba0:C0:T0:L0" Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE" Pattern matching part: @STRING:.esxi.month=Apr@ @STRING:.esxi.date=26@ @STRING:.esxi.time=15:17:31@@IPv4:.esxi.host_ip=192.168.88.71@@ESTRING:.esxi.program= vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE@@ANYSTRING:.esxi.message=cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE@ Matching part: Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE Values: MESSAGE=Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE PROGRAM=ESXI .classifier.class=esxi .classifier.rule_id=182437592347598 .esxi.month=Apr .esxi.date=26 .esxi.time=15:17:31 .esxi.host_ip=192.168.88.71 .esxi.program= vmkernel .esxi.message=cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE root@debian:~# my configuration like as below ######## esxi_pattern.xml ############ <?xml version="1.0" encoding="utf-8"?> <patterndb version='3' pub_date='2009-04-17'> <ruleset name='esxi' id='123456678'> <pattern>ESXI</pattern> <rules> <rule provider='Fone Bro' id='182437592347598' class='esxi'> <patterns> <pattern>@STRING:.esxi.month:@ @STRING:.esxi.date:@ @STRING:.esxi.time::@@IPv4:.esxi.host_ip:@ @ESTRING:.esxi.program::@ @ANYSTRING:.esxi.message@</pattern> </patterns> </rule> </rules> </ruleset> </patterndb> ######## syslog-ng.conf ######## #####Parser##### parser pattern_db { db_parser( file("/etc/syslog-ng/patterndb/esxi_pattern.xml")); }; #Check pattern matching destination udp_esxi_output { file("/var/log/pattern_output" template("=== $PROGRAM,${.esxi_month} ${.esxi.date} ${.esxi.time} HOST IP ${.esxi.host_ip},${.esxi.message}\n") template_escape(no)); }; #####Log##### log { source(s_network); parser(pattern_db); destination(udp_esxi_output); };

2 1

syslog-ng performance config calculator on Android
by Zoltán Pallagi 26 Apr '13

26 Apr '13

Hi guys, You know I like syslog-ng but also my hobby is Android programming. Because I wanted to practice (and develop my Android knowledge), I've just written a little interesting Android application related to syslog-ng performance tuning. It can calculate the tuning related settings like log_iw_size(), log_fetch_limit(), log_fifo_size() and so on, based on the given source specific parameters. Furthermore it can generate an example configuration that can be saved or sent via email. So it was absolutely just my hobby project related to Android, but after I showed it to a few people interested in syslog, I received positive feedbacks. After I decided to share it with everybody taking into consideration that I already have an Android developer account. I hope it will be useful, at least you can play with the numbers and results, but of course this is not a serious program just as I said my hobby project. You can download it from Android Market (and you can find more details here): https://play.google.com/store/apps/details?id=pzolee.android.syslogngconfig… Of course it's free and no ads. Have fun!

2 1

Re: [syslog-ng] syslog-ng Digest, Vol 96, Issue 23
by Davide D'Amico 26 Apr '13

26 Apr '13

> ------------------------------ > > Message: 3 > Date: Fri, 26 Apr 2013 11:29:39 +0200 > From: Balazs Scheidler <bazsi77(a)gmail.com> > Subject: Re: [syslog-ng] Configuration for a centralized syslog-ng > server > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu>, eh(a)gmail.com > Message-ID: > < > CAKcfE+bvXksZFdz77SkN8VCrmH15wwbTvUk8xJeWFLEwHpay7w(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > How do you know messages are dropped? Using freq_stats :) Anyway, I found the issue that wasn't related to syslog-ng. I had the syslog zfs partition on 92% so, after removing a lot of old files, everything went fine. -- d.

2 1

Configuration for a centralized syslog-ng server
by Davide D'Amico 26 Apr '13

26 Apr '13

Hi, I'm using syslog-ng OSE 3.3.8 on a FreeBSD 9.1 amd64 box on a centralized server (DELL R610, 32GB ram, ZFS with compressed filesystem) and 150 servers with syslog-ng that logs locally and send remotely their logs stream to the centralized syslog-ng. Sometime I see packets dropped, so I think I'm missing something on its configuration. That's what I'm using: - generic server: @version: 3.3 options { perm(0644); dir_perm(0750); create_dirs(yes); group (logs); dir_group (logs); log_fifo_size(10000); use_fqdn(yes); keep_hostname(yes); chain_hostnames(no); stats_freq(3600); }; source s_local { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; destination d_local { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$FACILITY.log"); }; destination d_remote { tcp("10.0.0.9" port(514)); }; log { source(s_local); destination(d_local); destination(d_remote); }; - centralized log server: @version: 3.3 options { perm(0644); dir_perm(0755); create_dirs(yes); group (logs); dir_group (logs); use_fqdn(yes); keep_hostname(yes); chain_hostnames(no); stats_freq(120); log_fifo_size(10000); frac_digits(3); }; source s_local { unix-dgram("/var/run/log" max_connections(20)); unix-dgram("/var/run/logpriv" perm(0600) max_connections(20)); internal(); file("/dev/klog"); }; filter f_localhost { netmask( "127.0.0.1" ); }; filter f_network6 { netmask( "172.16.6.0/255.255.255.0" ); }; destination d_local { file("/tank/syslog/custom/localhost/$YEAR/$MONTH/$DAY/$FACILITY.log"); }; source s_network { udp(ip("10.0.0.9") so_rcvbuf(16777216)); tcp(ip("10.0.0.9") port(514) log_fetch_limit(100) max_connections(200) log_iw_size(20000) so_rcvbuf(16777216)); }; filter f_www_host { host("www1.domain.lan") or host("www2.domain.lan") or host("www3.domain.lan"); }; [...] filter f_www_fac { facility(local6); }; [...] destination d_www { file("/tank/syslog-ng/custom/www/$YEAR/$MONTH/$DAY/$FACILITY.log"); }; [...] log { source(s_network); filter(f_www_host); filter(f_www_fac); destination(d_www); }; Thanks, -- d.

2 1

Re: [syslog-ng] rfc compliance and ciphersuites
by Balazs Scheidler 26 Apr '13

26 Apr '13

Well Syslog-ng can be compiled with SSL support using the openssl library in which case it supports at least TLS 1.1, maybe TLS 1.2 too but I'm not certain. Cipher suites can be configured using cipher-suite option within the TLS configuration block. We support all the algorithms that openssl supports. "Canter, Jeffrey (US SSA)" <jeffrey.canter(a)baesystems.com> wrote: >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq >

1 0

rfc compliance and ciphersuites
by Canter, Jeffrey (US SSA) 25 Apr '13

25 Apr '13

Hi We are using syslog-ng version 3.3. Does it conform to rfc 2246, rfc 4346 or rfc 5246? Also, what cipher suites does it support? Thanks.! Jeffrey Canter Member Technical Staff BAE Systems (W) 973-305-2577 (C) 201-320-9403

1 0

syslog-ng 3.3.9 has been released
by devel＠balabit.hu 23 Apr '13

23 Apr '13

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.3.9 SUMMARY : new stable release DATE : Apr 15, 2013 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.3.9) has been released. For latest fixes in the 3.3.x feature branch you are recommended to upgrade to this version. CHANGES: 3.3.9 Mon, 15 April 2013 15:00:00 +0100 Highlights ========== This release is a bug-fix release, correcting a handful of issues discovered since the previous one. Bugfixes ======== * A set/subst rewrite related segmentation fault has been fixed: if a rewrite rule doing either set or subst was referenced from multiple logpath, syslog-ng crashed. Other changes ============= * The systemd unit file now has Restart=on-failure set, to restart syslog-ng when it terminates unexpectedly. [#222] * When syslog-ng-ctl disconnects from syslog-ng, syslog-ng will not log an error due to the EOF, but an info-level message instead. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Balazs Scheidler <bazsi(a)balabit.hu> Gergely Nagy <algernon(a)balabit.hu> Johnson, Chris <chris.johnson3(a)hp.com> Lucas, Sascha <Sascha.Lucas(a)gisa.de> Paul Dann <pdgiddie+balabit(a)gmail.com> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

4 3

[Bug 231] New: eventlog: small windows compilation problem
by bugzilla＠bugzilla.balabit.com 23 Apr '13

23 Apr '13

https://bugzilla.balabit.com/show_bug.cgi?id=231 Summary: eventlog: small windows compilation problem Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Windows Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: ramon.garcia.f+syslog(a)gmail.com Type of the Report: --- Estimated Hours: 0.0 I am compiling eventlog-0.2.12+20120504+1700 under mingw64. I had a small issue compiling, because there is no alloca.h I'm attaching a small fix. malloc.h and alloca.h are checked by autoconf instead of by __WIN32__ Best regards. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[PATCH (3.5)]: Build system reimagined
by Gergely Nagy 22 Apr '13

22 Apr '13

Hi! The patch mentioned in the subject is far too big to include here (58 files changed, 1407 insertions(+), 890 deletions(-)), please see the feature/3.5/build-system-reorg[1] branch in my github repo. [1]: https://github.com/algernon/syslog-ng/commits/feature/3.5/build-system-reorg commit 7b3afe7a17685817e228b80d3da4cb95a35bec77 Author: Gergely Nagy <algernon(a)balabit.hu> Date: Mon Apr 22 11:31:29 2013 +0200 Build system reimagined This is a huge change, one that cannot be sensibly broken up into smaller pieces, so please bear with me! The purpose of the complete rewrite of the build system is to get rid of recursive make calls, and instead, use a single, non-recursive Makefile built up from multiple included parts, that has all the dependency information, therefore providing a much more robust dependency tracking, which is also significantly faster. For the sake of convenience, the Mk/populater-makefiles.sh script will add wrapper Makefiles to every directory that has a Makefile.am (unless it belongs to a third party library), allowing one to restrict 'make all' and 'make check' to a particular directory. The 'make check' provided by this convenience Makefile does not recurse into subdirectories, however. The system also provides shortcuts to build various parts of syslog-ng: - make syslog-ng - make mod-sql mod-mongodb mod-socket - etc Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> As said in the commit message itself, the main driving force behind the change is far better dependency tracking (which also brings us significant compile speed increase). I believe that while this is a huge change, and does have some drawbacks (the need for Mk/populate-makefiles.sh, for example), not having to play nasty tricks with SUBDIRS is already worth it: I've seen that break far too many times in the not too distant past, and the dependency tracking the new system brings gets rid of those problems pretty much forever. Comments, criticism, review and all that is more than welcome. -- |8]

1 0

[Bug 232] New: FEATURE: patterndb to support multiple correlation contexts
by bugzilla＠bugzilla.balabit.com 22 Apr '13

22 Apr '13

https://bugzilla.balabit.com/show_bug.cgi?id=232 Summary: FEATURE: patterndb to support multiple correlation contexts Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 I have come across a correlation requirement that the patterndb can not handle. The general idea is that I need to correlate three lines, where one line has two pieces of correlation information, each of which correlates to on of the other lines. Example: sm-mta[28270]: r3LLxvol028270: from=<someone(a)uvic.ca>, size=9506, class=0, nrcpts=1, msgid=<110bc310e87975113303806e139628b7.squirrel(a)wm3.uvic.ca>, proto=ESMTP, daemon=MTA, relay=[123.69.98.48] sm-mta[10644]: r3LLxvol028270: to=<someone(a)uvic.ca>, delay=00:00:00, pri=91535, stat=Rejected as outbound quota has been exceeded. squirrelmail: Message sent via webmail: by jdc (uvic.ca) at 142.104.193.193 on 04/21/2013 15:01:27: Message-ID: 110bc310e87975113303806e139628b7.squirrel(a)wm3.uvic.ca The first line has the ESMTPID (r3LLxvol028270) and the mail msgid (110bc310e87975113303806e139628b7.squirrel(a)wm3.uvic.ca) The second line only has the ESMTPID (r3LLxvol028270) The third line only has the mail msgid (110bc310e87975113303806e139628b7.squirrel(a)wm3.uvic.ca) So in this case, the only way to get the authenticated user that had the e-mail "Rejected as outbound quota has been exceeded" is to correlate the third line to the second line by using the two correlation components from the first line. I would recommend that the patterdb be changed to permit multiple correlation contexts <rule id="1" context-timeout="2" context-scope="program" provider="UVic"> <contexts> <context>$HOST:$esmtpid</context> <context>$HOST:$msgid</context> </contexts> <patterns> <pattern>@ESTRING:esmtpid::@ from=@QSTRING:from:<>@, size=@NUMBER@, class=@NUMBER@, nrcpts=@NUMBER@, msgid=@QSTRING:msgid:<>@</pattern> </patterns> <actions> <action trigger="timeout"> <message inherit-properties='TRUE'> <value name="MESSAGE">My message here</value> </message> </action> </actions> </rule> <rule id="2" context-timeout="2" context-scope="program" provider="UVic"> <contexts> <context>$HOST:$esmtpid</context> </contexts> <patterns> <pattern>@ESTRING:esmtpid::@ to=@QSTRING:to:<>@, delay=@ESTRING:delay",@ pri=@NUMBER@, stat=Rejected as outbound quota has been exceeded.</pattern> </patterns> <actions> <action trigger="timeout"> <message inherit-properties='TRUE'> <value name="MESSAGE">My message here</value> </message> </action> </actions> </rule> <rule id="3" context-timeout="2" context-scope="program" provider="UVic"> <contexts> <context>$HOST:$msgid</context> </contexts> <patterns> <pattern>Message sent via webmail: by @ESTRING:login: @@QSTRING:domain:()@ at @IPv4@ on @ESTRING:date:: @Message-ID: @ANYSTRING:msgid@</pattern> </patterns> <actions> <action trigger="timeout"> <message inherit-properties='TRUE'> <value name="MESSAGE">My message here</value> </message> </action> </actions> </rule> Obviously the action could do something a little more useful, but I think the point is clear that all three of these would be correlated together. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

tcp on syslog 2.0.x vs 3.3.x
by Hannes De Bondt 19 Apr '13

19 Apr '13

Best, Is it possible there is a different behaviour in the tcp destination. We see a different behaviour. We had a working setup with 2.0.x and while upgrading to 3.3.x we noticed the newlines in our messages are seen as EOM, causing a part of our logging to be lost. Is there a quick workaround for this? Kind regards Hannes De Bondt

3 2

insider 2013-04: syslog-ng presentation at LOADays; New maintenance releases; Comment the Adminguide online
by Peter Czanik 18 Apr '13

18 Apr '13

Dear syslog-ng users, This is the 23th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. FEATURED NEWS syslog-ng presentation at LOADays --------------------------------- Peter Czanik of BalaBit gave a presentation at LOADays, a conference focusing on system administrators. It was about the major new features of the syslog-ng 3.X series including a few short demos of these features. Participants were most interested in patterndb, correlation and AMQP and asked about upcoming features. The conference page is available at: http://loadays.org/ Blog about the event: https://czanik.blogs.balabit.com/2013/04/czp-loadays/ New maintenance releases ------------------------ While most people are interested in new features, the syslog-ng team is also working on maintenance releases which fix problems in already released software. A new maintenance version was released for the 3.3 series a few days ago and an other one is expected to arrive soon for the 3.4 series. Announcement: https://lists.balabit.hu/pipermail/syslog-ng-announce/2013-April/000157.html Comment the Adminguide online! ------------------------------ As you might know, we publish The syslog-ng Open Source Edition Administrator guide in three format: PDF, single-page HTML, and many-page HTML. The many-page HTML version of the OSE 3.3 and 3.4 guides have a new feature: online commenting. That means that you can easily give us feedback on any section of the adminguide. For example, you did not understand how X feature works? Let us know! You have found a typo? Please add a comment at the bottom of the page so we can correct it! You have a better, real-life configuration example instead of the one in the guide? Add it as a comment! Or even worse, there are no examples where it would be needed? If you already got a working example, please share it with us! Try it at http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-guid… BOOK OFFERING: Logging and Log Management: The Authoritative Guide to Understanding the Concepts Surrounding Logging and Log Management --------------------------------------------------- Effectively analyzing large volumes of diverse logs can pose many challenges. The recently published /Logging and Log Management /book helps to simplify this complex process using practical guidance and real-world examples. Packed with information you need to know for system, network and security logging. Log management and log analysis methods are covered in detail, including approaches to creating useful logs on systems and applications, log searching and log review. Chapter 5 describes you what is syslog-ng, and you also find some useful examples for deployment and configuration. http://www.amazon.com/Logging-Log-Management-Authoritative-Understanding/dp… SHORT NEWS: * A few thoughts about why logging is important: https://czanik.blogs.balabit.com/2013/04/why-logging-is-important/ NEW RELEASES: * syslog-ng 3.3.9: https://lists.balabit.hu/pipermail/syslog-ng-announce/2013-April/000157.html Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

High availability for syslog-ng
by Abhijeet Rastogi 16 Apr '13

16 Apr '13

Hi, Currently, I've just one syslog-ng server which receives messages from hundreds of rsyslog instances. I'm sending logs via UDP so if syslog-ng machine dies, logs will be missed. How can I make the system more redundant? I want to achieve something like if the current syslog-ng machine goes down, some other machine should be able to take it's role. Any kind of help is highly appreciated. Thanks -- Regards, Abhijeet Rastogi (shadyabhi) http://blog.abhijeetr.com

5 6

Passing args to blocks gives error in v.3.4.1
by Anton Koldaev 16 Apr '13

16 Apr '13

After an upgrade from 3.3.7 to 3.4.1: ... block root mylogs(log()) { }; mylogs(log(123)) ... Gives: Unknown argument; context='root block mylogs', arg='log', value='123' Error parsing config, syntax error, unexpected LL_ERROR, expecting $end in /etc/syslog-ng/syslog-ng.conf at line 11, column 1: mylogs(log(123)) ^^^^^^ Am I doing anything wrong? -- Best regards, Koldaev Anton

2 4

missing hostname from solaris client
by Lucas, Sascha 12 Apr '13

12 Apr '13

Hi, I have the following settings in my syslog-ng.conf: options { chain_hostnames(off); keep_hostname(yes); normalize_hostnames(yes); use_dns(no); }; mostly to get the original (case insensitive) hostname from the client. Solaris (10,11) clients don't send their hostname over the wire (check with tcpdump/wireshark). syslog-ng sets the client IP address to the hostname. Can someone tell me if solaris can be tweaked to send the hostname? Thanks, Sascha. Vorsitzender des Aufsichtsrates: Ralf Hiltenkamp Geschäftsführung: Michael Krüger (Sprecher), Stephan Drescher Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

2 2

[Bug 227] New: Feature request – Linux /dev/kmsg support
by bugzilla＠bugzilla.balabit.com 12 Apr '13

12 Apr '13

https://bugzilla.balabit.com/show_bug.cgi?id=227 Summary: Feature request – Linux /dev/kmsg support Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: grawity(a)gmail.com Type of the Report: enhancement Estimated Hours: 0.0 Starting with Linux 3.5 (commits [1], [2]), there is a new kmsg interface "/dev/kmsg", which allows multiple readers, is able to export some structured data (such as device name and subsystem), avoids some other problems /proc/kmsg had, such as the ones described in syslog-ng's FAQ [3]. Are there any plans to support this in syslog-ng? The format is explained in Documentation/ABI/testing/dev-kmsg.txt [4]. [1]: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… [2]: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… [3]: http://www.balabit.com/wiki/syslog-ng-faq-kmsg-klogd [4]: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/plain/Docum… -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

syslog-ng v3.3.4 on Ubuntu 12.04.2 LTS x_64 has a memory leak
by Clayton Dukes 11 Apr '13

11 Apr '13

Hi Guys, We have some folks doing an audit and they found that syslog-ng is leaking memory. This server is processing a steady 8000 events/second, 24 hours a day. syslog-ng is currently using 20GB of memory. Here is their comment: ===================== I've been watching syslog-ng memory usage and this looks like leaking to me (5MB growth every minute): root@logzilla:/etc/syslog-ng# while sleep 60; do ps auxw | grep /usr/sbin/syslog-ng | grep -v grep; done root 14004 26.4 20.6 20831384 20462180 ? Ssl Apr08 1024:00 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20467152 ? Ssl Apr08 1024:17 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20472132 ? Ssl Apr08 1024:33 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20477136 ? Ssl Apr08 1024:49 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20481932 ? Ssl Apr08 1025:06 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20486956 ? Ssl Apr08 1025:22 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20491700 ? Rsl Apr08 1025:39 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20496688 ? Ssl Apr08 1025:55 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20501576 ? Ssl Apr08 1026:11 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20506788 ? Ssl Apr08 1026:28 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20512480 ? Ssl Apr08 1026:44 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20518272 ? Ssl Apr08 1026:59 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20522940 ? Ssl Apr08 1027:16 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20528268 ? Ssl Apr08 1027:32 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20533184 ? Ssl Apr08 1027:49 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20538016 ? Ssl Apr08 1028:05 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20543132 ? Ssl Apr08 1028:22 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20548200 ? Ssl Apr08 1028:37 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20553124 ? Rsl Apr08 1028:54 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20557940 ? Ssl Apr08 1029:10 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20563312 ? Ssl Apr08 1029:26 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20568080 ? Ssl Apr08 1029:43 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20573176 ? Ssl Apr08 1029:59 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20578104 ? Rsl Apr08 1030:16 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20583076 ? Ssl Apr08 1030:32 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20588856 ? Ssl Apr08 1030:48 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20831384 20594296 ? Ssl Apr08 1031:03 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20831384 20599116 ? Ssl Apr08 1031:20 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20831384 20604028 ? Ssl Apr08 1031:36 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20608844 ? Ssl Apr08 1031:52 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20613796 ? Ssl Apr08 1032:08 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20618956 ? Ssl Apr08 1032:25 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20624292 ? Ssl Apr08 1032:41 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20629372 ? Ssl Apr08 1032:57 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20634284 ? Ssl Apr08 1033:13 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20639608 ? Ssl Apr08 1033:29 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20644384 ? Rsl Apr08 1033:45 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20649440 ? Rsl Apr08 1034:02 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20962456 20654116 ? Ssl Apr08 1034:18 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20962456 20659368 ? Rsl Apr08 1034:34 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20962456 20665300 ? Ssl Apr08 1034:50 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20962456 20671644 ? Ssl Apr08 1035:05 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 21027992 20676440 ? Rsl Apr08 1035:22 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 21027992 20681116 ? Ssl Apr08 1035:38 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 21027992 20686220 ? Ssl Apr08 1035:54 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20691032 ? Ssl Apr08 1036:11 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20696044 ? Ssl Apr08 1036:27 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20700944 ? Rsl Apr08 1036:43 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20705760 ? Ssl Apr08 1037:00 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20710540 ? Rsl Apr08 1037:18 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20715696 ? Ssl Apr08 1037:34 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20720316 ? Ssl Apr08 1037:51 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20725632 ? Ssl Apr08 1038:07 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20730196 ? Ssl Apr08 1038:24 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20735636 ? Ssl Apr08 1038:39 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20741476 ? Ssl Apr08 1038:56 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20749860 ? Ssl Apr08 1039:10 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20755808 ? Ssl Apr08 1039:24 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20761004 ? Ssl Apr08 1039:40 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20766152 ? Ssl Apr08 1039:57 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20771220 ? Ssl Apr08 1040:14 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20776268 ? Ssl Apr08 1040:30 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20781116 ? Ssl Apr08 1040:47 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20786176 ? Ssl Apr08 1041:03 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 21.0 21159192 20791412 ? Ssl Apr08 1041:19 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 21.0 21159192 20796124 ? Ssl Apr08 1041:36 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 21.0 21159192 20801112 ? Ssl Apr08 1041:53 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 21.0 21159192 20805952 ? Rsl Apr08 1042:10 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid ______________________________________________________________ Clayton Dukes ______________________________________________________________

3 5

[PATCH (3.4)] cfg_lexer: Drop quotes when expanding a backtick, and already quoted
by Gergely Nagy 09 Apr '13

09 Apr '13

In case we're expanding a backtick while we're already in a quoted string, and the backtick starts with a '"', drop the extra quotes. This allows blocks like: block source s_logfile (filename("messages")) { file("/var/log/`filename`"); }; source s_example { s_logfile(filename("logfile.log")); }; To work properly, and result in file("/var/log/logfile.log"); Reported-by: Eric Berggren <eric_berggren(a)apple.com> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/cfg-lexer.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/lib/cfg-lexer.c b/lib/cfg-lexer.c index fbce432..b1c7c93 100644 --- a/lib/cfg-lexer.c +++ b/lib/cfg-lexer.c @@ -156,12 +156,18 @@ gchar * cfg_lexer_subst_args(CfgArgs *globals, CfgArgs *defs, CfgArgs *args, gchar *cptr, gsize *length) { gboolean backtick = FALSE; + gboolean in_string = FALSE; gchar *p, *ref_start = cptr; GString *result = g_string_sized_new(32); p = cptr; while (*p) { + if (!backtick && (*p) == '"') + { + in_string = !in_string; + } + if (!backtick && (*p) == '`') { /* start of reference */ @@ -195,7 +201,12 @@ cfg_lexer_subst_args(CfgArgs *globals, CfgArgs *defs, CfgArgs *args, gchar *cptr arg = NULL; *p = '`'; - g_string_append(result, arg ? arg : ""); + if (in_string && arg && arg[0] == '"') + { + g_string_append_len(result, &arg[1], strlen(arg) - 2); + } + else + g_string_append(result, arg ? arg : ""); } } else if (!backtick) -- 1.7.10.4

1 0

[PATCH 0/3]: Support systemd notifications
by Gergely Nagy 09 Apr '13

09 Apr '13

The patchset coming after this implements support for Type=notify units, and support for the STATUS notifications in systemd. This means that syslog-ng becomes able to signal systemd upon startup when it finished starting up, and thanks to the STATUS notifications, an administrator will be able to check syslog-ng's status with systemctl. If a reload fails for example, that will be shown there. -- |8]

1 3

Re: [syslog-ng] syslog-ng Digest, Vol 96, Issue 6
by Yarick Tsagoyko 09 Apr '13

09 Apr '13

Dear Ramon, the config looks ok, What is the issue you are having ? --Yarick. On Mon, Apr 8, 2013 at 3:25 PM, <syslog-ng-request(a)lists.balabit.hu> wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: Syslog-ng 3.1.4 on OpenBSD 5.2 (Ramon F McDougall) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 8 Apr 2013 15:25:25 -0400 > From: Ramon F McDougall <cyberjet(a)live.com> > Subject: Re: [syslog-ng] Syslog-ng 3.1.4 on OpenBSD 5.2 > To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> > Message-ID: <BAY148-W654AE36D7E7FB13020FC85B7C50(a)phx.gbl> > Content-Type: text/plain; charset="windows-1252" > > Greetings > to All, > > > > I > need your help, I recently installed Syslog-ng on an OpenBSD 5.2 and > decided to > try syslog-ng to work under this environment. I?m not 100% sure(trying to > learn about all these things) that it?s > working the way it?s supposed to. I followed an example detailed in this > link: > http://kimiushida.com/bitsandpieces/articles/openbsd_syslog-ng/index.html > > It?s my hope that someone with much more expertise than I share > some of their knowledge so that I can get this working. I have configured > the > firewall to send to my syslog server v3.1.4. Does anyone have this working > on > OpenBSD and can share their config files? > > > > $ cd syslog-ng > > syslog-ng.conf > syslog-ng.conf.original > > $ more syslog-ng.conf > > # syslog-ng configuration file for OpenBSD. > > # This should provide the same behavior as OpenBSD's > syslog.conf(5). > > # 2010-07-18 steven(a)openbsd.org > > > > @version: 3.0 > > > > options { > > use_dns(no); > > > create_dirs(no); > > > keep_hostname(yes); > > }; > > > > source s_local { > > unix-dgram > ("/dev/log"); > > unix-dgram > ("/var/empty/dev/log"); > > internal(); > > }; > > #source s_local_all { > > # unix-dgram > ("/dev/log"); > > # unix-dgram > ("/var/empty/dev/log"); > > # unix-dgram > ("/var/www/dev/log"); > > # internal(); > > #}; > > #source s_net { > > # > udp(port(514)); > > #}; > > > > destination d_console > { file("/dev/console"); > }; > > destination d_messages > { file("/var/log/messages" owner(root) group(wheel) > perm(0644)); }; > > destination d_authlog > { file("/var/log/authlog" owner(root) group(wheel) > perm(0640)); }; > > destination d_secure > { file("/var/log/secure" owner(root) group(wheel) > perm(0600)); }; > > destination d_cronlog > { file("/var/cron/log" owner(root) group(wheel) > perm(0600)); }; > > destination d_daemon > { file("/var/log/daemon" owner(root) group(wheel) > perm(0640)); }; > > destination d_xferlog > { file("/var/log/xferlog" owner(root) group(wheel) > perm(0640)); }; > > destination d_lpderrs > { file("/var/log/lpd-errs" owner(root) group(wheel) > perm(0640)); }; > > destination d_maillog > { file("/var/log/maillog" owner(root) group(wheel) > perm(0600)); }; > > destination d_uucplog > { file("/var/log/uucp" owner(uucp) group(dialer) > perm(0660)); }; > > destination d_sudolog > { file("/var/log/sudo"); > }; > > destination d_chatlog > { file("/var/log/chat"); > }; > > destination d_ttyall > { usertty("*"); > }; > > destination d_ttyroot > { usertty("root"); > }; > > destination d_loghost > { udp("loghost" port(514)); > }; > > > > destination d_network_hosts { file > ("/var/log/bcm/$HOST.log"); }; > > > > filter f_notice { > > level(notice > .. emerg) > > and > not(facility(auth,authpriv,cron,ftp,kern,lpr,mail,user)); > > }; > > filter f_kerndebug { > > level(debug .. > emerg) and facility(kern); > > }; > > filter f_msginfo { > > level(info .. > emerg) and facility(syslog,user); > > }; > > filter f_authinfo { > > level(info .. > emerg) and facility(auth); > > }; > > filter f_authprivdebug { > > level(debug .. > emerg) and facility(authpriv); > > }; > > filter f_croninfo { > > level(info .. > emerg) and facility(cron); > > }; > > filter f_daemoninfo { > > level(info .. > emerg) and facility(daemon); > > }; > > filter f_ftpinfo { > > level(info .. > emerg) and facility(ftp); > > }; > > filter f_lprdebug { > > level(debug .. > emerg) and facility(lpr); > > }; > > filter f_mailinfo { > > level(info .. > emerg) and facility(mail); > > }; > > filter f_uucpinfo { > > level(info .. > emerg) and facility(uucp); > > }; > > filter f_emerg { > > level(emerg); > > }; > > filter f_to_console { > > not > (facility(authpriv)) and > > ((level(notice > .. emerg) and facility(auth)) > > or > (level(debug .. emerg) and facility(kern)) > > or (level(crit > .. emerg) and facility(mail)) > > or level(err > .. emerg)); > > }; > > filter f_to_root { > > (level(debug > .. emerg) and facility(auth)) > > or (level(notice .. emerg)); > > }; > > filter f_to_loghost { > > (level(notice > .. emerg) and > > not > (facility(auth,authpriv,cron,ftp,kern,lpr,mail,user))) > > or (level(info > .. emerg) and facility(auth,daemon,syslog,user)) > > or > (level(debug .. emerg) and facility(authpriv,kern)); > > }; > > filter f_prog_sudo { > > > program("sudo"); > > }; > > filter f_prog_chat { > > > program("chat"); > > }; > > > > log { source(s_local); filter(f_notice); destination(d_messages);}; > > log { source(s_local); filter(f_kerndebug); destination(d_messages);}; > > log { source(s_local); filter(f_msginfo); destination(d_messages);}; > > log { source(s_local); filter(f_authinfo); destination(d_authlog); }; > > log { source(s_local); filter(f_authprivdebug); > destination(d_secure); }; > > log { source(s_local); filter(f_croninfo); destination(d_cronlog); }; > > log { source(s_local); filter(f_daemoninfo); destination(d_daemon); }; > > log { source(s_local); filter(f_ftpinfo); destination(d_xferlog); }; > > log { source(s_local); filter(f_lprdebug); destination(d_lpderrs); }; > > log { source(s_local); filter(f_mailinfo); destination(d_maillog); }; > > #log { source(s_local); filter(f_uucpinfo); destination(d_uucplog); }; > > > > # Uncomment this line to send "important" messages > to the system > > # console: be aware that this could create lots of output. > > #log { source(s_local); filter(f_to_console); destination(d_console); }; > > > > # Uncomment this to have all messages of notice level and > higher > > # as well as all authentication messages sent to root. > > #log { source(s_local); filter(f_to_root); destination(d_ttyroot); }; > > > > # Everyone gets emergency messages. > > log { source(s_local); filter(f_emerg); destination(d_ttyall); }; > > > > # Uncomment to log to a central host named > "loghost". > > #log { source(s_local); filter(f_to_loghost); destination(d_loghost); }; > > > > # Uncomment to log messages from sudo(8) and chat(8) to > their own > > # respective log files. > Matches are done based on the program name. > > # Program-specific logs: > > #log { source(s_local); filter(f_prog_sudo); destination(d_sudolog); }; > > #log { source(s_local); filter(f_prog_chat); destination(d_chatlog); }; > > > > # Uncomment to log messages from the network. > > # Note: it is recommended to specify a different destination > here. > > #log { source(s_net); destination(d_messages); }; > > $ syslog-ng-ctl > > Syntax: syslog-ng-ctl <command> [options] > > Possible commands are: > > stats Dump syslog-ng statistics > > verbose Enable/query verbose messages > > debug Enable/query debug messages > > trace Enable/query trace messages > > > > # syslog-ng-ctl stats > > SourceName;SourceId;SourceInstance;State;Type;Number > > center;;received;a;processed;0 > > destination;d_lpderrs;;a;processed;0 > > destination;d_messages;;a;processed;6 > > src.internal;s_local#2;;a;processed;5 > > src.internal;s_local#2;;a;stamp;1365446582 > > destination;d_daemon;;a;processed;0 > > destination;d_secure;;a;processed;0 > > center;;queued;a;processed;0 > > global;payload_reallocs;;a;processed;0 > > global;sdata_updates;;a;processed;0 > > destination;d_xferlog;;a;processed;0 > > destination;d_authlog;;a;processed;2 > > destination;d_cronlog;;a;processed;0 > > destination;d_maillog;;a;processed;0 > > global;msg_clones;;a;processed;0 > > source;s_local;;a;processed;7 > > destination;d_ttyall;;a;processed;0 > > # syslog-ng-ctl verbose --set=on > > # syslog-ng-ctl stats > > SourceName;SourceId;SourceInstance;State;Type;Number > > center;;received;a;processed;0 > > destination;d_lpderrs;;a;processed;0 > > destination;d_messages;;a;processed;9 > > src.internal;s_local#2;;a;processed;8 > > src.internal;s_local#2;;a;stamp;1365446909 > > destination;d_daemon;;a;processed;0 > > destination;d_secure;;a;processed;0 > > center;;queued;a;processed;0 > > global;payload_reallocs;;a;processed;0 > > global;sdata_updates;;a;processed;0 > > destination;d_xferlog;;a;processed;0 > > destination;d_authlog;;a;processed;2 > > destination;d_cronlog;;a;processed;0 > > destination;d_maillog;;a;processed;0 > > global;msg_clones;;a;processed;0 > > source;s_local;;a;processed;10 > > destination;d_ttyall;;a;processed;0 > > # > Please let me know what more information you need to be able to help. > Regards and Thank you,?Ramon > > > >

1 0

Re: [syslog-ng] Syslog-ng 3.1.4 on OpenBSD 5.2
by Ramon F McDougall 08 Apr '13

08 Apr '13

Greetings to All, I need your help, I recently installed Syslog-ng on an OpenBSD 5.2 and decided to try syslog-ng to work under this environment. I’m not 100% sure(trying to learn about all these things) that it’s working the way it’s supposed to. I followed an example detailed in this link: http://kimiushida.com/bitsandpieces/articles/openbsd_syslog-ng/index.html It’s my hope that someone with much more expertise than I share some of their knowledge so that I can get this working. I have configured the firewall to send to my syslog server v3.1.4. Does anyone have this working on OpenBSD and can share their config files? $ cd syslog-ng syslog-ng.conf syslog-ng.conf.original $ more syslog-ng.conf # syslog-ng configuration file for OpenBSD. # This should provide the same behavior as OpenBSD's syslog.conf(5). # 2010-07-18 steven(a)openbsd.org @version: 3.0 options { use_dns(no); create_dirs(no); keep_hostname(yes); }; source s_local { unix-dgram ("/dev/log"); unix-dgram ("/var/empty/dev/log"); internal(); }; #source s_local_all { # unix-dgram ("/dev/log"); # unix-dgram ("/var/empty/dev/log"); # unix-dgram ("/var/www/dev/log"); # internal(); #}; #source s_net { # udp(port(514)); #}; destination d_console { file("/dev/console"); }; destination d_messages { file("/var/log/messages" owner(root) group(wheel) perm(0644)); }; destination d_authlog { file("/var/log/authlog" owner(root) group(wheel) perm(0640)); }; destination d_secure { file("/var/log/secure" owner(root) group(wheel) perm(0600)); }; destination d_cronlog { file("/var/cron/log" owner(root) group(wheel) perm(0600)); }; destination d_daemon { file("/var/log/daemon" owner(root) group(wheel) perm(0640)); }; destination d_xferlog { file("/var/log/xferlog" owner(root) group(wheel) perm(0640)); }; destination d_lpderrs { file("/var/log/lpd-errs" owner(root) group(wheel) perm(0640)); }; destination d_maillog { file("/var/log/maillog" owner(root) group(wheel) perm(0600)); }; destination d_uucplog { file("/var/log/uucp" owner(uucp) group(dialer) perm(0660)); }; destination d_sudolog { file("/var/log/sudo"); }; destination d_chatlog { file("/var/log/chat"); }; destination d_ttyall { usertty("*"); }; destination d_ttyroot { usertty("root"); }; destination d_loghost { udp("loghost" port(514)); }; destination d_network_hosts { file ("/var/log/bcm/$HOST.log"); }; filter f_notice { level(notice .. emerg) and not(facility(auth,authpriv,cron,ftp,kern,lpr,mail,user)); }; filter f_kerndebug { level(debug .. emerg) and facility(kern); }; filter f_msginfo { level(info .. emerg) and facility(syslog,user); }; filter f_authinfo { level(info .. emerg) and facility(auth); }; filter f_authprivdebug { level(debug .. emerg) and facility(authpriv); }; filter f_croninfo { level(info .. emerg) and facility(cron); }; filter f_daemoninfo { level(info .. emerg) and facility(daemon); }; filter f_ftpinfo { level(info .. emerg) and facility(ftp); }; filter f_lprdebug { level(debug .. emerg) and facility(lpr); }; filter f_mailinfo { level(info .. emerg) and facility(mail); }; filter f_uucpinfo { level(info .. emerg) and facility(uucp); }; filter f_emerg { level(emerg); }; filter f_to_console { not (facility(authpriv)) and ((level(notice .. emerg) and facility(auth)) or (level(debug .. emerg) and facility(kern)) or (level(crit .. emerg) and facility(mail)) or level(err .. emerg)); }; filter f_to_root { (level(debug .. emerg) and facility(auth)) or (level(notice .. emerg)); }; filter f_to_loghost { (level(notice .. emerg) and not (facility(auth,authpriv,cron,ftp,kern,lpr,mail,user))) or (level(info .. emerg) and facility(auth,daemon,syslog,user)) or (level(debug .. emerg) and facility(authpriv,kern)); }; filter f_prog_sudo { program("sudo"); }; filter f_prog_chat { program("chat"); }; log { source(s_local); filter(f_notice); destination(d_messages);}; log { source(s_local); filter(f_kerndebug); destination(d_messages);}; log { source(s_local); filter(f_msginfo); destination(d_messages);}; log { source(s_local); filter(f_authinfo); destination(d_authlog); }; log { source(s_local); filter(f_authprivdebug); destination(d_secure); }; log { source(s_local); filter(f_croninfo); destination(d_cronlog); }; log { source(s_local); filter(f_daemoninfo); destination(d_daemon); }; log { source(s_local); filter(f_ftpinfo); destination(d_xferlog); }; log { source(s_local); filter(f_lprdebug); destination(d_lpderrs); }; log { source(s_local); filter(f_mailinfo); destination(d_maillog); }; #log { source(s_local); filter(f_uucpinfo); destination(d_uucplog); }; # Uncomment this line to send "important" messages to the system # console: be aware that this could create lots of output. #log { source(s_local); filter(f_to_console); destination(d_console); }; # Uncomment this to have all messages of notice level and higher # as well as all authentication messages sent to root. #log { source(s_local); filter(f_to_root); destination(d_ttyroot); }; # Everyone gets emergency messages. log { source(s_local); filter(f_emerg); destination(d_ttyall); }; # Uncomment to log to a central host named "loghost". #log { source(s_local); filter(f_to_loghost); destination(d_loghost); }; # Uncomment to log messages from sudo(8) and chat(8) to their own # respective log files. Matches are done based on the program name. # Program-specific logs: #log { source(s_local); filter(f_prog_sudo); destination(d_sudolog); }; #log { source(s_local); filter(f_prog_chat); destination(d_chatlog); }; # Uncomment to log messages from the network. # Note: it is recommended to specify a different destination here. #log { source(s_net); destination(d_messages); }; $ syslog-ng-ctl Syntax: syslog-ng-ctl <command> [options] Possible commands are: stats Dump syslog-ng statistics verbose Enable/query verbose messages debug Enable/query debug messages trace Enable/query trace messages # syslog-ng-ctl stats SourceName;SourceId;SourceInstance;State;Type;Number center;;received;a;processed;0 destination;d_lpderrs;;a;processed;0 destination;d_messages;;a;processed;6 src.internal;s_local#2;;a;processed;5 src.internal;s_local#2;;a;stamp;1365446582 destination;d_daemon;;a;processed;0 destination;d_secure;;a;processed;0 center;;queued;a;processed;0 global;payload_reallocs;;a;processed;0 global;sdata_updates;;a;processed;0 destination;d_xferlog;;a;processed;0 destination;d_authlog;;a;processed;2 destination;d_cronlog;;a;processed;0 destination;d_maillog;;a;processed;0 global;msg_clones;;a;processed;0 source;s_local;;a;processed;7 destination;d_ttyall;;a;processed;0 # syslog-ng-ctl verbose --set=on # syslog-ng-ctl stats SourceName;SourceId;SourceInstance;State;Type;Number center;;received;a;processed;0 destination;d_lpderrs;;a;processed;0 destination;d_messages;;a;processed;9 src.internal;s_local#2;;a;processed;8 src.internal;s_local#2;;a;stamp;1365446909 destination;d_daemon;;a;processed;0 destination;d_secure;;a;processed;0 center;;queued;a;processed;0 global;payload_reallocs;;a;processed;0 global;sdata_updates;;a;processed;0 destination;d_xferlog;;a;processed;0 destination;d_authlog;;a;processed;2 destination;d_cronlog;;a;processed;0 destination;d_maillog;;a;processed;0 global;msg_clones;;a;processed;0 source;s_local;;a;processed;10 destination;d_ttyall;;a;processed;0 # Please let me know what more information you need to be able to help. Regards and Thank you,…Ramon

1 0

Getting milliseconds in logs
by Abhijeet Rastogi 05 Apr '13

05 Apr '13

Hi, I want to get a complete ISO8601 timestamp format in syslog-ng. Something like: 2013-04-04T18:44:34.694692+00:00 When I enable, ts_format("iso"), I'm not able to get milliseconds precision and what I get is something like 2013-04-05T02:57:07+00:00 For some reason, I really need milliseconds resolution. How can I achieve that in syslogn-ng? -- Regards, Abhijeet Rastogi (shadyabhi) http://blog.abhijeetr.com

3 4

how to archive logs efficiently
by Daniel Neubacher 05 Apr '13

05 Apr '13

Hey there, my syslog-ng has gotten quite big with 50k logs per second and the server seems to hit the io limit at night. While a few month ago I could run a gzip with ionice over all old logs the server doesn't like it anymore and quite a lot of logs are storing while the compression lasts. I'm using the ose so I've got no logstore. And for a second I've thought about writing the logs a compressed fuse fs but... fuse :P So how are you guys doing it? -- Daniel Neubacher, Network Administrator daniel.neubacher(a)xing.com<mailto:daniel.neubacher@xing.com> XING AG Gaensemarkt 43, 20354 Hamburg, Germany Tel. +49 40 419131-28, Fax +49 40 419131-11 Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 98807 Exec. Board (Vorstand): Dr. Stefan Groß-Selbeck (Vorsitzender), Dr. Thomas Vollmoeller, Ingo Chu, Dr. Helmut Becker, Jens Pape Chairman of the Supervisory Board (Aufsichtsratsvorsitzender): Dr. Neil Sunderland This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden and may be unlawful.

5 7

reloading (HUP) syslog-ng -> mutilation of messages in mongodb
by Lucas, Sascha 04 Apr '13

04 Apr '13

Hi, after reloading syslog-ng 3.4.1 (SIGHUP) I have random issues with mutilation of messages to a mongodb destination. Sometimes the value of the MESSAGE key is just truncated. An other time i.e. LEGACY_MSGHDR, MESSAGE, PROGRAM are empty and the HOST value is mutilated. And sometimes syslog-ng stops inserting into mongodb. Any hints on this? TIA, Sascha. Vorsitzender des Aufsichtsrates: Ralf Hiltenkamp Geschäftsführung: Michael Krüger (Sprecher), Stephan Drescher Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

2 3