- syslog-ng - lists.balabit.hu

RE: [syslog-ng]syslog-ng dying randomly?
by Russo, Ben 17 May '02

17 May '02

I too had a problem with syslog-ng 1.4.14 dying randomly on my RedHat Linux 7.2 box. I did a number of things and now it runs reliably. (at least for the last few weeks it hasn't had any problems) I don't know what fixed the problem but I will tell you what steps I took... I stoped using v1.4.14 and started using 1.5.17 In the config file options I added the following: time_reap(12); gc_busy_threshold(768); because in my particular environment I found that syslog-ng would have thousands of open files, this fixed that and lsof only shows hundreds of open files. I also started logging to a ReiserFS filesystem rather than ext2fs because I found that the directory scan performance on ext2fs slows to a crawl if you are constantly adding and removing files from a directory. (even when the directory was empty it was hundreds of KB) BTW, you might be interested in this: syslog-ng to SQL database HOWTO http://www.umialumni.com/~ben/SYSLOG-DOC.html -Ben.

2 1

syslog-ng survey
by Balazs Scheidler 16 May '02

16 May '02

Hi, Please find the time to fill out the survey below to help us to further improve syslog-ng. You can either fill it out in this mail message by entering the appropriate marks in the brackets, or on-line by pointing your browser to this url: http://www.balabit.hu/en/downloads/syslog-ng/survey/ Thanks in advance, -------------------------------------------------------------------------- Dear syslog-ng users, Syslog-ng as a free software has been a tremendous success. It's been in wide use for almost four years now as the first release was made back in 1998. As syslog-ng is a free software product it is very difficult to estimate the number of users of syslog-ng. Nevertheless we had over 40000 downloads in six months, and we have over 500 subscribers on our mailing list. These numbers are not exact either as syslog-ng is included in several GNU/Linux distributions like Debian. According to the Debian package popularity contest (12th May 2002) syslog-ng was used on 3% of all Debian boxes (based on 1587 submissions). To support the continous development of syslog-ng we plan to create a commercial branch, and add related services to our portfolio (consulting, training and support). Please help us to improve syslog-ng and related services, and fill the enclosed survey and send it back to syslog-ng-survey(a)balabit.hu. Which features do you think important to add into syslog-ng? Give importance of each feature as a number between 1 (least important) and 5 (most important). [ ] cryptographically protected logfiles stored on the local disk [ ] cryptographically protected network transmission of log information [ ] disk based message buffering to avoid losing messages [ ] flow controlled message path to avoid losing messages (cause sending programs to stop responding if log events cannot be stored) [ ] integrated support for database backends (PostgreSQL, MySQL, Oracle) [ ] integrated support for log analysis (event correlation, statistics, suspicious events) [ ] integrated support for e-mail/pager alerts [ ] integrated support for log rotation/compression [ ] support for more platforms [ ] binary distributions for different platforms with installation program [ ] graphical user interface (GUI) for syslog-ng configuration [ ] integration tools for non-UNIX platforms (NT EventLog) What platforms are you using/plan to use syslog-ng on? Check all that apply! [ ] Linux [ ] FreeBSD/OpenBSD/NetBSD [ ] AIX [ ] HP-UX [ ] Solaris [ ] Irix [ ] Tru64 [ ] SCO Unix [ ] Other, please specify: Are you using a central syslog server? [ ] yes, we use syslog-ng on our central syslog server [ ] yes, we use a central syslog server, but it is not syslog-ng based [ ] no, we have no central syslog server, but we plan to install one [ ] no, we don't have central syslog server, and have no plans on installing one How many hosts are you running syslog-ng on? [ ] 1-10 [ ] 11-25 [ ] 26-50 [ ] 51-100 [ ] 101-250 [ ] 251-500 [ ] Other, please specify: How many devices are you logging to syslog-ng used as log host? [ ] 1-10 [ ] 11-25 [ ] 26-50 [ ] 51-100 [ ] 101-250 [ ] 251-500 [ ] 501-1000 [ ] Other, please specify Would you or your company be willing to provide syslog-ng related services to third parties? [ ] yes [ ] no Would you or your company pay for syslog-ng licenses if there was no important difference between the GPLd and non-GPLd version? [ ] yes [ ] no Would you or your company pay for syslog-ng licenses if there were important differences between the GPLd and non-GPLd version? [ ] yes [ ] no Would you or your company pay for consulting services related to syslog-ng? [ ] yes [ ] no Would you or your company pay for training services related to syslog-ng? [ ] yes [ ] no Would you or your company pay for support services related to syslog-ng? [ ] yes [ ] no -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

4 6

syslog-ng dying randomly?
by John Morrissey 16 May '02

16 May '02

[warning: really long post follows] I'm running syslog-ng 1.4.14 on a number of Red Hat 7.1/7.2 systems. It's configured fairly simply, writing logs to /var/log/programname.$YEAR$MONTH$DATE and also forwards logs via UDP to a central syslog-ng hub. client config: options { use_fqdn(on); chain_hostnames(off); sync(0); }; source s_local { internal(); unix-stream("/dev/log"); }; source s_kmsg { file("/proc/kmsg"); }; destination d_sort_program { file("/var/log/$PROGRAM.$MONTH$DAY$YEAR" group("logs") perm(0640) create_dirs(yes) dir_group("logs") dir_perm(0750) ); }; destination d_syslog_hub { udp(172.16.1.4 port(514)); }; log { source(s_local); source(s_kmsg); destination(d_sort_program); destination(d_syslog_hub); }; The problem is that syslog-ng seems to die on a fairly regular basis. I can't say for sure if it's because our syslog hub wasn't available for an extended period of time or if it's due to some sort of problem with the code. I'm doing some testing to see if the availability of the hub makes any difference and I'll make a follow-up in a few days. Anyway, I was curious if anyone had an idea on what might be going on. An strace of syslog-ng on one of the machines before it died is very interesting. poll([{fd=6, events=0}, {fd=5, events=0, revents=POLLERR}, {fd=2, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 5, 100) = 1 time(NULL) = 1021313163 getpid() = 17061 time(NULL) = 1021313163 open("/var/log/syslog-ng.05132002", O_WRONLY|O_NONBLOCK|O_APPEND|O_CREAT|O_NOCTTY, 0640) = 0 chown32("/var/log/syslog-ng.05132002", 0, 6000) = 0 fcntl64(0, F_GETFL) = 0xc01 (flags O_WRONLY|O_NONBLOCK|O_APPEND) fcntl64(0, F_SETFL, O_WRONLY|O_NONBLOCK|O_APPEND) = 0 fcntl64(0, F_SETFD, FD_CLOEXEC) = 0 time(NULL) = 1021313163 time(NULL) = 1021313163 time(NULL) = 1021313163 close(5) = 0 poll([{fd=0, events=0}, {fd=6, events=0}, {fd=2, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 5, 100) = 0 getpid() = 17061 time(NULL) = 1021313163 getpid() = 17061 time(NULL) = 1021313163 getpid() = 17061 time(NULL) = 1021313163 getpid() = 17061 time(NULL) = 1021313163 And so on, alternating between getpid() and time() until it finally segfaults and dies. A backtrace is also interesting; it seems like syslog-ng might be getting caught in an infinite loop: #0 0x400b49c9 in chunk_alloc (ar_ptr=0x0, nb=0) at malloc.c:2843 #1 0x400b4818 in __libc_malloc (bytes=88) at malloc.c:2811 #2 0x08053b22 in debug_malloc () #3 0x08053bdd in xalloc () #4 0x08053da0 in ol_string_alloc () #5 0x08051203 in c_format_cstring () #6 0x0804b98b in make_internal_message () #7 0x080503e6 in write_internal_message () #8 0x08053291 in msg_vformat () #9 0x0805339c in fatal () #10 0x08053e3d in ol_object_check () #11 0x0804a7c6 in do_add_source_name () #12 0x080503fc in write_internal_message () #13 0x08053291 in msg_vformat () #14 0x0805339c in fatal () #15 0x08053e3d in ol_object_check () #16 0x0804a7c6 in do_add_source_name () #17 0x080503fc in write_internal_message () #18 0x08053291 in msg_vformat () #19 0x0805339c in fatal () #20 0x08053e3d in ol_object_check () #21 0x0804a7c6 in do_add_source_name () #22 0x080503fc in write_internal_message () #23 0x08053291 in msg_vformat () #24 0x0805339c in fatal () Calls #20 - #24 repeat over and over. The entire backtrace is huge, almost 35,000 calls. Here's the beginning of it: #34475 0x08053e3d in ol_object_check () #34476 0x0804a7c6 in do_add_source_name () #34477 0x080503fc in write_internal_message () #34478 0x08053291 in msg_vformat () #34479 0x0805339c in fatal () #34480 0x08053e3d in ol_object_check () #34481 0x0804a7c6 in do_add_source_name () #34482 0x080503fc in write_internal_message () #34483 0x08053291 in msg_vformat () #34484 0x0805339c in fatal () #34485 0x080544d7 in dont_free_live_resource () #34486 0x080543f3 in do_resource_free () #34487 0x08053961 in gc_sweep () #34488 0x08053a5b in gc () #34489 0x08053aea in gc_maybe () #34490 0x080515df in io_iter () #34491 0x0804a095 in main_loop () #34492 0x0804a3d1 in main () #34493 0x40050647 in __libc_start_main (main=0x804a1c8 <main>, argc=2, ubp_av=0xbffff754, init=0x8049664 <_init>, fini=0x8054620 <_fini>, rtld_fini=0x4000dcd4 <_dl_fini>, stack_end=0xbffff74c) at ../sysdeps/generic/libc-start.c:129 It looks like it's getting caught in an infinite loop which finally exhausts its stack space and causes it to segfault(?). If you need any more information, let me know. I also still have the core if anybody wants it. Any ideas would be much appreciated! thanks, john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

3 6

bug in "template"?
by Gehring, Andrew x66132 16 May '02

16 May '02

On AIX 4.3.3... When I specify a template for a destination as follows: destination d_mesg { file("/var/log/messages" template("$DATE $HOST $PROGRAM [$FACILITY $LEVEL] $MSG)); }; send a logger messages logger -p user.notice -t TEST "This is a test" what ends up in the log file is: May 15 08:42:51 LEWIS TEST: [USER NOTICE] TEST: This is a test So in what I'm seeing, and I've tried a few different 'templates', is that $PROGRAM is included in $MSG. Is that the way it is supposed to be? Thanks, Andrew

2 1

log option "final" question
by Jason Price 15 May '02

15 May '02

When I use the "final" flag in a log statement, does that mean: 1) All log statements listed later will not be used at all or 2) All log messages matching all the filters in that log statement will not be processed by log statements listed later ? The documentation isn't quite clear (from logpath.html): This flag means that the processing of log statements ends here. Note that this doesn't necessarily mean that matching messages will be stored once, as they can be matching log statements processed prior the current one. It seems to imply the second definition, and the first one makes little sense at all. This really is just a request for clarification in the docs I guess. Jason

1 0

Re: syslog-ng dying randomly?
by Balazs Scheidler 15 May '02

15 May '02

On Tue, May 14, 2002 at 07:34:37PM -0400, John Morrissey wrote: > [warning: really long post follows] > > I'm running syslog-ng 1.4.14 on a number of Red Hat 7.1/7.2 systems. It's > configured fairly simply, writing logs to > /var/log/programname.$YEAR$MONTH$DATE and also forwards logs via UDP to a > central syslog-ng hub. It seems to be a memory corruption problem. As I fixed one in 1.4.15 please try that version first (a single byte at random memory address could be decremented by one). If the problem persists, I might need some more information. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

How to get logs from firewall through syslog-ng
by Krishna 15 May '02

15 May '02

Hi, Wednesday, May 15, 2002 1:02:10 PM I am using syslog-ng 1.4.14 . I want to know how I should configure syslog-ng to get logs from firewall. I am using RedHat6.0 Please Help -- regards, Krishna mailto:Krishna_shekhar@gmx.net Krishna Shekhar Network Administrator Wiplash.Net ___ __________________________________________ __ __ | / /___ _/__ __ \__ /___ |_ ___/__ / / / __ | /| / / __ / __ /_/ /_ / __ /| |____ \__ /_/ / __ |/ |/ / __/ / _ ____/_ /___ ___ |___/ /_ __ / ____/|__/ /___/ /_/ /_____/_/ |_/____/ /_/ /_/ http://Wiplash2000.com

1 0

syslog-ng doesn't re-open the TCP connection - resolved
by Rosenberg, Relu (Exchange) 14 May '02

14 May '02

This was an OS patching issue, not related with syslog-ng Relu Rosenberg *********************************************************************** Bear Stearns is not responsible for any recommendation, solicitation, offer or agreement or any information about any transaction, customer account or account activity contained in this communication. ***********************************************************************

1 0

RE: [syslog-ng]syslog-ng + Snort RESOLVED
by Elton Ramos Carvalho 14 May '02

14 May '02

Folksm, I resolved my problem removing LOG_ALERT from snort configuration file. ;o) -----Original Message----- From: Elton Ramos Carvalho [mailto:elton_carvalho@datasul.com.br] Sent: Tuesday, May 14, 2002 9:56 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng + Snort Hi, The syslog-ng don't log any alert of snort. I'm using syslog-ng-1.5.17 and the configuration file syslog-ng.conf.sample tha come with it. The syslog is loging all snort alerts without problem. I'm using snort with -s option and LOG_ATHPRIV and LOG_ALERT in configuration file Tks

1 0

syslog-ng + Snort
by Elton Ramos Carvalho 14 May '02

14 May '02

Hi, The syslog-ng don't log any alert of snort. I'm using syslog-ng-1.5.17 and the configuration file syslog-ng.conf.sample tha come with it. The syslog is loging all snort alerts without problem. I'm using snort with -s option and LOG_ATHPRIV and LOG_ALERT in configuration file Tks

1 0

Forwarding syslog messages via UDP not working , help with config file please.
by Subodh Nijsure 13 May '02

13 May '02

Hello, I have following statement in my config file destination udp_forw { udp("192.168.58.150", port(514)); }; log { source(blade17) ; destination(blade17log) ; destination(udp_forw); }; What I observe is the messages are getting logged to local file, but the remote syslog daemon doesn't receive those messages. The remote syslogd is not syslog-ng its a standard syslogd. /Subodh Nijsure

2 1

Problem with syslog-ng on HP-UX 11.0
by dcntrnoc＠cmp.com 08 May '02

08 May '02

Hi all, I have been running syslog-ng on a handful of Solaris boxes for some time now with no problems, and am attempting to get it running on HP-UX. I have compiled (with gcc) and installed syslog-ng 1.5.16 and libol 0.3.2 on a system running HP-UX 11.00. I am using the following source statement in my config file: source s_sys { pipe("/dev/log"); internal(); }; The filters are based on facility. It seems that the only readable output in the destination files come from either the internal source (ex. May 7 17:47:24 myhost syslog-ng[5675]: SIGHUP received, restarting syslog-ng), or from a message I sent via logger. The rest of the output looks like this: May 7 17:48:22 myhost ^F May 7 17:48:22 myhost ^B May 7 17:48:22 myhost ^B May 7 17:48:22 myhost À^_'^SÀ^_'^S^?|Fä May 7 17:48:22 myhost ^?~^U` May 7 17:48:22 myhost ^?|Fä May 7 17:48:22 myhost ^?|Fä^?|FäÀ^Ve{À^XAW May 7 17:48:22 myhost ^?|Ç@ May 7 17:48:22 myhost >@^?{à May 7 17:48:22 myhost ^O May 7 17:48:22 myhost ^A May 7 17:48:22 myhost ^?|Fä^?|FäÀ^_Î^[À^X¯^_ May 7 17:48:22 myhost ^D^?~^U`^?{à May 7 17:48:22 myhost May 7 17:48:22 myhost ^A May 7 17:48:22 myhost ^?|Fä^?|FäÀ^_Õs May 7 17:48:22 myhost ^?|Fä May 7 17:48:22 myhost À^XD» May 7 17:48:22 myhost @ May 7 17:48:22 myhost >@^?|¿À^?{à May 7 17:48:22 myhost À^XA May 7 17:48:22 myhost ^A^?|¡À May 7 17:48:22 myhost ^B^?|¡ÔÀ^S«H May 7 17:48:22 myhost ^?|Fä May 7 17:48:22 myhost À^X^[wÀ E¯ May 7 17:48:22 myhost ^?|¿ÀÀ^Wåp Any ideas? I don't know quite what to make of this. Thanks, Sharon. __________________________________________________________________________________________ Any views or opinions are solely those of the author and do not necessarily represent those of CMP Media. The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. If you are not the intended recipient of this message please do not read, copy, use or disclose this communication and notify the sender immediately. It should be noted that any review, retransmission, dissemination or other use of, or taking action or reliance upon, this information by persons or entities other than the intended recipient is prohibited. __________________________________________________________________________________________

1 0

syslog-ng doesn't re-open the TCP connection
by Rosenberg, Relu (Exchange) 08 May '02

08 May '02

This is syslog-ng 1.4.13 on Solaris 8, reading from named pipe and sending over tcp to a central server syslog-ng. Configuration file: options { long_hostnames (on) ; use_dns (no) ; use_fqdn (yes) ; keep_hostname (yes) ; chain_hostnames (no) ; log_fifo_size(1000) ; } ; source s_pipe { pipe ("/tmp/.syslog-ng.pipe") ; internal () ; } ; destination d_tcp { tcp (remote_host port(2222)) ; } ; log { source (s_pipe) ; destination (d_tcp) ; } ; In order not to replace the syslog I tail the /var/adm/messages and redirect into the /tmp/.syslog-ng.pipe. Syslog-ng is reading the pipe and sending to remote syslog-ng over tcp. At a point in time it stopped sending messages, doesn't try to re-open the lost TCP connection. The connection may have been lost due to network outage or maintenance work, but it should reopen. This happens to over 10 clients, I have over 300 working this way. The truss output shows the read of new messages from named pipe, but no attempt to write, or to re-open the connection to the remote server 51/1: poll(0xFFBEFB10, 2, 60000) = 1 351/1: read(3, " M a y 7 1 8 : 2 8".., 1024) = 70 351/1: time() = 1020810505 351/1: time() = 1020810505 351/1: time() = 1020810505 351/1: time() = 1020810505 351/1: poll(0xFFBEFB10, 2, 100) = 0 351/1: poll(0xFFBEFB10, 2, 60000) (sleeping...) 351/2: signotifywait() (sleeping...) 351/3: lwp_cond_wait(0xFF0F55B0, 0xFF0F55C0, 0xFF1F5C48) (sleeping...) thanks Relu Rosenberg **************************************************************** Bear Stearns is not responsible for any recommendation, solicitation, offer or agreement or any information about any transaction, customer account or account activity contained in this communication. ***********************************************************************

1 0

where is ftp location for syslog-ng
by Steve Cobrin 08 May '02

08 May '02

Hi there, I'm interested in experimenting with syslog-ng. I usually much prefer to download software using ftp rather than http. Is there a main ftp site or mirror site.? The syslog-ng web page refers to ftp://ftp.fsn.hu/pub/syslog-ng but I have been unable to connect to the site since January, with the site complaining that the directory doesn't have read permission. Can anybody help? -- Steve

1 0

Syslog Dropping Information
by Jim Gifford 07 May '02

07 May '02

I have noticed over the last few weeks, that it seems that I have been dropping information from the kernel log. I am not sure if it is my configuration. I have tried two different ways of accessing information from /proc/kmsg. I have tried pipe without klogd. I have tried file with klogd. It seems to happen at random times. Here is my system information. Linux 2.4.18 Syslog-ng 1.5.17 Here is a copy of my config. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames(off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source src { unix-stream("/dev/log"); internal(); file("/proc/kmsg"); }; destination authlog { file("/var/log/authorize.log"); }; destination syslog { file("/var/log/syslog.log"); }; destination fcron { file("/var/log/fcron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kernel { file("/var/log/kernel.log"); }; destination cups { file("/var/log/cups.log"); }; destination user { file("/var/log/user.log"); }; destination mail { file("/var/log/mail.log"); }; destination fetchmail { file("/var/log/fetchmail.log"); }; destination news { file("/var/log/news.log"); }; destination debug { file("/var/log/debug.log"); }; destination messages { file("/var/log/messages.log"); }; destination everything { file("/var/log/everything.log"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; destination iptables { file("/var/log/iptables.log"); }; destination hacker { file("/var/log/hacker.log"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_fcron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kernel { facility(kern); }; filter f_cups { facility(lpr); }; filter f_mail { facility(mail); }; filter f_fetchmail { match("fetchmail"); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_everything { level(debug..emerg); }; filter f_iptables { match("IN="); }; filter f_hacker { match("Hacker"); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_fcron); destination(fcron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kernel); destination(kernel); }; log { source(src); filter(f_cups); destination(cups); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_fetchmail); destination(fetchmail); }; log { source(src); filter(f_news); destination(news); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(f_everything); destination(everything); }; log { source(src); filter(f_iptables); destination(iptables); }; log { source(src); filter(f_hacker); destination(hacker); }; log { source(src); destination(console_all); };

3 3

Year problems?
by William Yodlowsky 06 May '02

06 May '02

I haven't seen this one before. Running syslog-ng 1.5.13 on Solaris 8 64bit. It only handles logs locally for that one machine (config below). The problem: when the logfiles rolled over to May, I ended up with two logfiles for May 1: a "maillog-05-01-2001" and "maillog-05-01-2002". I know the file isn't simply leftover from last year, because this box didn't exist last year. :) Oddly enough, it seems that the 2001 file was used for May 1 up until 3:59am, and at 4:00am the 2002 file picks up where it left off. The machine has no crontabs that run at 4am (or 3am for that matter). No one logged in and did anything. Any ideas at all? Thanks in advance... syslog-ng.conf: --------------- options { long_hostnames(off); keep_hostname(yes); use_dns(no); }; source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination mail { file("/var/log/maillog-$MONTH-$DAY-$YEAR" create_dirs(yes)); }; destination others { file("/var/log/messages-$YEAR-$MONTH" create_dirs(yes)); }; filter mail { program("postfix") or program("amavis") or program("amavisd"); }; filter others { not program("postfix"); }; log { source(src); filter(mail); destination(mail); }; log { source(src); filter(others); destination(others);};

2 2

RE: [syslog-ng]Syslog-ng and Mysql
by Toby Nelson 06 May '02

06 May '02

1.4.15 >>> Michael.Earls(a)chmcc.org 05/06/02 08:13AM >>> what ver of syslog-ng? -----Original Message----- From: nelsotob(a)ohsu.edu Sent: Monday, May 06, 2002 11:14 AM To: <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng]Syslog-ng and Mysql Yes that is actually what I have in my script is INSERT just a typo in the messages. Toby >>> sander(a)sanderscorner.com 05/04/02 04:39AM >>> (Response to message from Toby Nelson, nelsotob(a)ohsu.edu) Hello Toby, Should'nt it be 'template("INSERT INTO...'? Regards, Sander Saturday, May 04, 2002, 1:14:08 AM, you wrote: > Can someone help me? > I have syslog ng running perfectly getting all info from all of my hosts. I would like to take this one step farther and start adding it to a mysql data base. I have made the mysql.pipe using > mkfifo and add the following lines to my syslog ng.conf: > destination d_mysql { > pipe("/etc/mysql.pipe" template("INSET INTO logs(host, facility, priority, level, tag, date, time, program, msg) VALUES('$HOST', '$FACILILITY', '$PRIORITY', '$LEVEL', '$TAG', > '$YEAR $MONTH $DAY', $HOUR:$MIN:$SEC', '$PROGRAM', $MSG');\n") template escape(yes)); > }; _______________________________________________ syslog ng maillist syslog ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]Syslog-ng and Mysql
by Toby Nelson 06 May '02

06 May '02

Yes that is actually what I have in my script is INSERT just a typo in the messages. Toby >>> sander(a)sanderscorner.com 05/04/02 04:39AM >>> (Response to message from Toby Nelson, nelsotob(a)ohsu.edu) Hello Toby, Should'nt it be 'template("INSERT INTO...'? -- Regards, Sander Saturday, May 04, 2002, 1:14:08 AM, you wrote: > Can someone help me? > I have syslog-ng running perfectly getting all info from all of my hosts. I would like to take this one step farther and start adding it to a mysql data base. I have made the mysql.pipe using > mkfifo and add the following lines to my syslog-ng.conf: > destination d_mysql { > pipe("/etc/mysql.pipe" template("INSET INTO logs(host, facility, priority, level, tag, date, time, program, msg) VALUES('$HOST', '$FACILILITY', '$PRIORITY', '$LEVEL', '$TAG', > '$YEAR-$MONTH-$DAY', $HOUR:$MIN:$SEC', '$PROGRAM', $MSG');\n") template-escape(yes)); > }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Syslog-ng and Mysql
by Michael Earls 06 May '02

06 May '02

what ver of syslog-ng? -----Original Message----- From: nelsotob(a)ohsu.edu Sent: Monday, May 06, 2002 11:14 AM To: <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng]Syslog-ng and Mysql Yes that is actually what I have in my script is INSERT just a typo in the messages. Toby >>> sander(a)sanderscorner.com 05/04/02 04:39AM >>> (Response to message from Toby Nelson, nelsotob(a)ohsu.edu) Hello Toby, Should'nt it be 'template("INSERT INTO...'? Regards, Sander Saturday, May 04, 2002, 1:14:08 AM, you wrote: > Can someone help me? > I have syslog ng running perfectly getting all info from all of my hosts. I would like to take this one step farther and start adding it to a mysql data base. I have made the mysql.pipe using > mkfifo and add the following lines to my syslog ng.conf: > destination d_mysql { > pipe("/etc/mysql.pipe" template("INSET INTO logs(host, facility, priority, level, tag, date, time, program, msg) VALUES('$HOST', '$FACILILITY', '$PRIORITY', '$LEVEL', '$TAG', > '$YEAR $MONTH $DAY', $HOUR:$MIN:$SEC', '$PROGRAM', $MSG');\n") template escape(yes)); > }; _______________________________________________ syslog ng maillist syslog ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog ng

1 0

How does the log_fifo_size option work?
by Eric Benzacar 06 May '02

06 May '02

Can someone please clarify what the log_fifo_size option does within the file() option for me please? I don't understand the docs, nor how to use it: log_fifo_size() number The number of entries in the output fifo. Use global setting. What is the "output fifo"? Thanks! Eric

2 1

Syslog-ng and Mysql
by Toby Nelson 04 May '02

04 May '02

Can someone help me? I have syslog-ng running perfectly getting all info from all of my hosts. I would like to take this one step farther and start adding it to a mysql data base. I have made the mysql.pipe using mkfifo and add the following lines to my syslog-ng.conf: destination d_mysql { pipe("/etc/mysql.pipe" template("INSET INTO logs(host, facility, priority, level, tag, date, time, program, msg) VALUES('$HOST', '$FACILILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', $HOUR:$MIN:$SEC', '$PROGRAM', $MSG');\n") template-escape(yes)); }; log { source("src"); destination("d_mysql"); }; With that in place I continue to get a parse error. Can any one help? Thanks, Toby

2 1

Penny L Creech/Nationwide/NWIE is out of the office.
by CREECHP＠Nationwide.com 04 May '02

04 May '02

I will be out of the office starting 05/03/2002 and will not return until 05/13/2002. I will respond to your message when I return.

1 0

RE: syslog-ng digest, Vol 1 #683 - 3 msgs
by Aerts,Bas 03 May '02

03 May '02

probably you should recompile tcpwrappers with the 'process_options' feature enabled in the Makefile (or something like that) for enhanced language options (:-((: ########################################### # Optional: Turning on language extensions # # Instead of the default access control language that is documented in # the hosts_access.5 document, the wrappers can be configured to # implement an extensible language documented in the hosts_options.5 # document. This language is implemented by the "options.c" source # module, which also gives hints on how to add your own extensions. # Uncomment the next definition to turn on the language extensions # (examples: allow, deny, banners, twist and spawn). # #STYLE = -DPROCESS_OPTIONS # Enable language extensions. chrs. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] Sent: Friday, April 26, 2002 6:25 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng digest, Vol 1 #683 - 3 msgs Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-admin(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: syslog-ng and AIX (Ed Ravin) 2. Re: Error when compiling with tcp-wrappers (Ed Ravin) 3. Re: Random Directories (Nate Campi) --__--__-- Message: 1 Subject: Re: [syslog-ng]syslog-ng and AIX To: syslog-ng(a)lists.balabit.hu Date: Thu, 25 Apr 2002 13:43:57 -0400 (EDT) From: "Ed Ravin" <eravin(a)panix.com> Reply-To: syslog-ng(a)lists.balabit.hu Balazs Scheidler writes: > > -F or --foreground options Oh dear, this is what I get for reading an outdated man page instead of looking at the program itself. --__--__-- Message: 2 Subject: Re: [syslog-ng]Error when compiling with tcp-wrappers To: syslog-ng(a)lists.balabit.hu Date: Thu, 25 Apr 2002 13:49:45 -0400 (EDT) From: "Ed Ravin" <eravin(a)panix.com> Reply-To: syslog-ng(a)lists.balabit.hu Balazs Scheidler writes: > > On Wed, Apr 24, 2002 at 11:38:25PM -0400, Ed Ravin wrote: > > ./configure --prefix=/install/syslog-ng-1.5.16 --enable-tcp-wrapper --with- libol=/src/build/libol-0.3.2 [...] > > checking for hosts_access in -lwrap... no > > checking whether to enable TCP wrapper support... yes > > > > So clearly something is broken in the configure process. > > can you check config.log why it fails? Here's the log: configure:2725: checking for tcpd.h configure:2735: gcc -E conftest.c >/dev/null 2>conftest.out configure:2762: checking for hosts_access in -lwrap configure:2781: gcc -o conftest -g -O2 conftest.c -lwrap 1>&5 /usr/lib/libwrap.so: undefined reference to `allow_severity' /usr/lib/libwrap.so: undefined reference to `deny_severity' collect2: ld returned 1 exit status configure: failed program was: #line 2770 "configure" #include "confdefs.h" /* Override any gcc2 internal prototype to avoid an error. */ /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char hosts_access(); int main() { hosts_access() ; return 0; } configure:2811: checking whether to enable TCP wrapper support I think the fix is that the test program should define "allow_severity" and "deny_severity", since those are required to be in the user program for it to compile successfully. --__--__-- Message: 3 Date: Thu, 25 Apr 2002 18:26:51 -0700 From: Nate Campi <nate(a)campin.net> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Random Directories protocol="application/pgp-signature"; boundary="bKyqfOwhbdpXa4YI" Reply-To: syslog-ng(a)lists.balabit.hu --bKyqfOwhbdpXa4YI Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Apr 25, 2002 at 10:59:43AM +0200, Balazs Scheidler wrote: > On Wed, Apr 24, 2002 at 10:47:11AM -0700, Nate Campi wrote: > > On Wed, Apr 24, 2002 at 10:32:20AM -0700, Painter, Jennifer wrote: > > > Directories with names like " Error", " SCSI", "," > > >=20 > > > Are showing up in the directory that holds the syslogs for the differ= ent hosts that we monitor. =20 > > >=20 > > > Has anyone seen these random directories. Any suggestions on how to = deal with them. > >=20 > > I want a macro taken from gethostbyaddr() instead of from the message > > contents that could be used to force a valid hostname no matter what. > >=20 > try the attached patch.=20 >=20 > ps: if this patches proves to be stable, I'll release 1.5.17 Working as expected, on a lightly loaded loghost. I'll report back tomorrow. Thanks. --=20 "Press any key... no, no, no, NOT THAT ONE!" -Anon. =20 =20 "Enter any 11-digit prime number to continue..." -Anon. =20 --bKyqfOwhbdpXa4YI Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8yKzbWpDEZMF673kRAh6FAJ0Ss0ojsCDCKwUg8YIf6ItBYFLrSwCeJOnK l5Tnlp4KTRExjeYW0FZa48M= =Q0Lh -----END PGP SIGNATURE----- --bKyqfOwhbdpXa4YI-- --__--__-- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng End of syslog-ng Digest

1 0

Syslog-ng newbie needs help with remote logging. Please?
by Jeroen Baten 03 May '02

03 May '02

Hello, I tried to get remote loggin to work but somehow it doesn't. I've put the following line on the host that should sent the messages: (as you can see, there are two attempts). destination server_syslog { udp("10.1.1.2" port(514); }; log { source(src); destination(server_syslog); }; destination d_udp { udp("10.1.1.2" port(514); localport(514)); }; log { source(src); destination(d_udp); }; on the receiving host my config is: source net { udp(); }; log { source(net); destination(allmessages); }; Can you tell me what my error is? I am using SuSE 7.3 with syslog-ng 1.4.12 All help is appreciated. Kind regards, -- Jeroen Baten | EMAIL : JEROEN(a)I2RS.NL ____ _ __ | web : www.i2rs.nl | )|_)(_ | tel : +31 (0)30 221 00 11 _|_/_| \__) | fax : +31 (0)30 220 31 91 Kometenlaan 26, 3721 JT, Bilthoven

1 0

RE: [syslog-ng]syslog-ng
by Abraham, Ajamu 03 May '02

03 May '02

I am trying to do the same thing. I got three datacenters and I am logging all my routers and switches to syslog-ng servers in each location. I finally got sqlsyslogd working on a test server but noticed that the format in which my logs come into the database is wrong. Can you tell me if you was able to accomplish your goal and if so can you send me a sample config on how to tailor the logs before it is entered into the database. Thanks in advance. Ajamu Abraham Network Engineer About The Human Internet <http://about.com> 1440 Broadway, 20th Floor New York, NY 10018 Direct: (212) 204-1525 Cell: (917) 416-3800 "l'argent comptant règne tout autour de moi" -----Original Message----- From: Michael Earls [mailto:Michael.Earls@chmcc.org] Sent: Monday, April 08, 2002 2:18 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog-ng The reason I want it to log to a database is that I have over 100 routers and switches in different cities, I want a central Syslog server, I want all of techs in each city to be able to view the Syslog messages from a web browser anywhere. The only way I know to do this is have Syslog log to some database then have php/perl search from the web. What is the best way for me to do this with Syslog-ng? thanks michael -----Original Message----- From: bazsi(a)balabit.hu Sent: Wednesday, April 03, 2002 4:55 AM To: <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng]syslog-ng On Wed, Apr 03, 2002 at 03:38:03AM 0500, Michael Earls wrote: > Will syslog ng ever be native to log to mysql or any other type of > external database? I don't understand what the problems with using an external program for such purpose are. Simply write a 10 line long perl script where you can even preprocess messages before they go to the database, and feed this script with a pipe/program destination. Adding support for pgsql/mysql/sybase/whatever into syslog ng is bloat in my opinion. Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog ng maillist syslog ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Trouble with using syslog-ng "source" with specific IP address and UDP ...
by John E Spence, CISSP 30 Apr '02

30 Apr '02

Hi; I've installed syslog-ng onto my Sun Solaris 8 machine. I'm using syslog-ng-1.4.15 and libol-0.2.23. Everything works well unless I try to setup a source statement with a specific IP address in it. This works fine: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source nonlocalA { udp(ip(0.0.0.0) port(514)); }; source nonlocalB { udp(ip(0.0.0.0) port(2000)); }; destination local-dest { file("/var/log/messages"); }; destination nonA-dest { file("/export/home0/syslog-ng/logA"); }; destination nonB-dest { file("/export/home0/syslog-ng/logB"); }; log { source(local); destination(local-dest); }; log { source(nonlocalA); destination(nonA-dest); }; log { source(nonlocalB); destination(nonB-dest); }; If I add these lines . source eval1 { udp(ip(10.55.70.113) port(514)); }; destination eval1-dest { file("/export/home0/syslog-ng/eval1"); } log { source(eval1); destination(eval1-dest); }; .. syslog-ng fails to start and I get this message: "io.c: bind_inet_socket() bind failed 10.55.70.113:514 Cannot assign requested address Error initializing configuration, exiting." I've looked carefully at other examples and the documents, and I don't understand what I've done wrong. Can anyone help? Thanks very much. ----------------------------------------------- John E Spence, CISSP --------------------------------------------

2 1

syslog-ng-1.4.15: libol-0.3.2 < libol-0.2.23
by Ed Grimm 29 Apr '02

29 Apr '02

Your configure script is messed. I managed to get it to compile using the following patch, although I don't know if the precidence rules are right for this to be the full working version. Ed --- configure Sat Apr 27 14:56:29 2002 +++ configure.new Sat Apr 27 14:56:11 2002 @@ -2626,6 +2626,7 @@ LIBOL_PATCH=`echo $LIBOL_VERSION | sed -e 's/[0-9]*\.[0-9]*\.$[0-9]*$/\1/'` if test "$LIBOL_MAJOR" != "$LIBOL_REQ_MAJOR" -o \ "$LIBOL_MINOR" -lt "$LIBOL_REQ_MINOR" -o \ + "$LIBOL_MINOR" -eq "$LIBOL_REQ_MINOR" -a \ "$LIBOL_PATCH" -lt "$LIBOL_REQ_PATCH"; then echo "$ac_t""no" 1>&6 { echo "configure: error: Required libol version not found, found $LIBOL_VERSION instead" 1>&2; exit 1; }

2 1

syslog-ng and DNS
by Jerome Peducasse 29 Apr '02

29 Apr '02

If a computer reboot before DNS server, syslog-ng disallows starting because it can't resolve IP address of loghost. It's akward because computer can't write in local destination. Thx. -- Jerome Peducasse

9 17

Startup errors not correctly reported back
by Borsenkow Andrej 29 Apr '02

29 Apr '02

Mandrake 8.2 that is using initscirpts very much like RedHat. Standard configuration boots with OK/FAIL indication for every service started on bootup that looks approximately like Starting syslog-ng: [ OK ] - or - [FAIL] Note that "success" or "fail" means simply application returned 0/non-0 exit code. Syslog-ng forks off very early, even before it starts to parse configuration file. It means that any error (even any fatal error) is not ever reported back so startup always appears to succeed. This is confusing. Looking in source, it appears that any possible startup errors happen in make_syslog_config() (of course, there can be run-time errors but that is different matter). Any reason why make_syslog_config() cannot be moved before fork? -andrej

1 0

Anyone got a good Solaris 8 client config to spare?
by Tighe Schlottog 26 Apr '02

26 Apr '02

If so, thanks in advance. Tighe Schlottog

3 2

fix for the -HUP problem
by Balazs Scheidler 26 Apr '02

26 Apr '02

hi, for all those who had problems with SIGHUP processing, please try this patch: diff -u -r1.49 affile.c --- affile.c 2002/04/12 07:42:16 1.49 +++ affile.c 2002/04/26 09:28:07 @@ -894,7 +903,7 @@ if (self->flags & AFFILE_NO_EXPAND) { if (!self->writers) { - self->writers = make_affile_dest_writer(self, self->template_fname); + self->writers = make_affile_dest_writer(self, ol_string_use(self->template_fname)); res = LOG_HANDLER_INIT(self->writers, self->cfg, NULL); if (res & ST_QUIT) return NULL; The problem doesn't occur if your destination files have macros in their names. This might affect the 1.4 versions as well. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 2

Random Directories
by Painter, Jennifer 26 Apr '02

26 Apr '02

Directories with names like " Error", " SCSI", "," Are showing up in the directory that holds the syslogs for the different hosts that we monitor. Has anyone seen these random directories. Any suggestions on how to deal with them. Thanks

3 3

HOWTO GET SYSLOGS INTO POSTGRESQL SQL DATABASE
by Russo, Ben 26 Apr '02

26 Apr '02

HOWTO HOW TO GET SYSLOGS INTO POSTGRESQL SQL DATABASE originally by Ben Russo 04/25/2002 AUDIENCE This document is intended to be read by a UNIX System Administrator with at least a year or two of experience. This document is heavily biased towards RedHat LINUX because the author likes RedHat Linux. If you want to do this on another UNIX platform, more power to you, but I won't be writing a document about how to do it. Feel free to use this document however you want. (My friends suggest that it comes in handy in the toilet and next to the fireplace). You can modify it and redistribute it however you want to, but please (just a suggestion) leave my name as the *original* author. There are no guarantees or warrantees about the advice given here. It is full of mispeellings and grammar mistakes for which I will never make no apologiez. GOAL The goal of this document is to provide a procedure for creating a centralized SYSLOG sink that imports syslog messages into a postgreSQL database and provides ODBC access to that database. So that you can use PgAdmin or MS Access to generate Syslog Reports. You could theoretically set up triggers in Postgres (based on inserts) that would cause your system to kick off other jobs (like paging the sysadmin). But that won't be covered here. CREDITS & THANKS I would like to thank Open Source developers everywhere, I hesitate to mention names because there are so many of them and they all deserve great recognition. However I will mention a few that are relevant to this document, there are many more people as well but you are going to skip this section anyway so why bother. Balázs Scheidler (author & maintainer of syslog-ng) Thanks for all your hard work! Bruce Momjian (author of the PostgreSQL Book from which I learned much about databases, and a major contributor to the PostgreSQL database project) I would dedicate this document to open source developers, but it sucks so much I don't want to embarress them. HOWTO.... Set up a PC with the latest version of Linux and all the patches. (You could use any UNIX, but I like Linux, and I wrote this.) You can set it up however you like best but make sure that you at least install the following: ssh/scp bind cacheing-nameserver config ntp postgreSQL syslog-ng After installing your box, make sure that it is on the network. If I were you I would disable everything else on the box that is network accessible. Set up bind to be started at boot time and set forwarders to your default name servers and set up forward only. Set the /etc/resolv.conf to point at 127.0.0.1 This setup is designed to create a forwarding only caching DNS server that will increase the performance of the syslog-ng server when doing NS-LOOKUPS Set up and configure ntp to be started at boot time. Make sure that the systems default time zone is set for UCT (Universal Coordinated Time). This is important for this box because all our syslogs will be coming from different zones. Even the Neutral Zone. Get the latest tarball for libol and syslog-ng from the balabit website (where syslog-ng is from). use "rpm -tb " on the tarballs (you will need all the development tools and compilers and devel libs and rpm-build installed, as well as the kernel headers) (****USE RPMS THEY ARE GOOD FOR YOU****) The rpm -tb command will create i386.rpm binary install packages for libol and syslog-ng and put them in /usr/src/redhat/RPMS/i386 use "rpm -Uvh" on the newly created rpms to install them. Then "cd /usr/etc" and "mkdir /etc/syslog-ng; ln -s ../../etc/syslog-ng syslog-ng" in the /etc/syslog-ng directory place the following into syslog-ng.conf *******************************BEGIN FILE /etc/syslog-ng/syslog-ng.conf # syslog-ng configuration file for RedHat 7.2 # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # Originall: 20000925 gb(a)sysfive.com # Modified: 20020424 ben(a)pleasenospam.tnsi.com # options { sync (0); time_reopen (10); log_fifo_size (100); long_hostnames (on); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); time_reap(12); gc_busy_threshold(768); }; ############################################################################ ### source s_sys { unix-stream ("/dev/log"); internal(); }; source s_udp { udp(); }; ############################################################################ ### # destination d_files { file("/var/log/syslog-ng/$HOST/$FACILITY.$LEVEL" # template("$ISODATE $HOST $FACILITY $PRIORITY $PROCESS $MSG\n")); # }; destination d_msgs { file("/var/log/messages" template("$FULLDATE $HOST $FACILITY.$PRIORITY $MSG\n")); }; destination d_mail { file("/var/log/maillog" template("$FULLDATE $HOST mail.$PRIORITY $MSG\n")); }; destination d_secure { file("/var/log/secure" template("$FULLDATE $HOST authpriv.$PRIORITY $MSG\n")); }; destination d_cron { file("/var/log/cron" template("$FULLDATE $HOST cron.$PRIORITY $MSG\n")); }; destination d_bootlog { file("/var/log/boot.log" template("$FULLDATE $HOST local7.$PRIORITY $MSG\n")); }; destination d_tty12 { pipe("/dev/tty12" template("$FULLDATE $FACILITY.$PRIORITY $MSG\n")); }; destination d_postgres { file("/var/lib/pgsql/syslog/datafiles/fulllog.$YEAR.$MONTH.$DAY.$HOUR.$MIN.$ SEC" template("INSERT INTO msg_table VALUES $ '$R_ISODATE', '$S_ISODATE', '$HOST', '$FACILITY', '$PRIORITY', '$MSG'$\;\n") template_escape(yes) owner(postgres)); }; ############################################################################ #### ############################################################################ #### filter f_msgs { host("syslog") and level(warning,err,crit,alert,emerg) and not facility(mail,authpriv,cron); }; filter f_mail { host("syslog") and facility(mail); }; filter f_cron { host("syslog") and facility(cron); }; filter f_secure { host("syslog") and facility(authpriv); }; filter f_bootlog { host("syslog") and facility(local7); }; filter f_tty12 { host("syslog") and level(crit,alert,emerg); }; ############################################################################ ###### ############################################################################ ###### # log { source(s_sys); source(s_udp); destination(d_files); }; log { source(s_sys); source(s_udp); filter(f_msgs); destination(d_msgs); }; log { source(s_sys); source(s_udp); filter(f_mail); destination(d_mail); }; log { source(s_sys); source(s_udp); filter(f_secure); destination(d_secure); }; log { source(s_sys); source(s_udp); filter(f_cron); destination(d_cron); }; log { source(s_sys); source(s_udp); filter(f_bootlog); destination(d_bootlog); }; log { source(s_sys); source(s_udp); filter(f_tty12); destination(d_tty12); }; # This allows you to hit "ALT-F12" on a Linux console and get # all the important log messages scrolling up your screen. log { source(s_sys); source(s_udp); destination(d_postgres); }; **************************END OF FILE /etc/syslog-ng/syslog-ng.conf then set up your syslog-ng init script in /etc/rc.d/init.d like so: **************************BEGIN FILE /etc/rc.d/init.d/syslog-ng #!/bin/bash # # syslog-ng Starts syslog-ng/klogd. # # # chkconfig: 2345 12 88 # description: Syslog-ng is the facility by which many daemons use to log \ # messages to various system log files. It is a good idea to always \ # run syslog-ng. # Source function library. . /etc/init.d/functions : ############################################################################ #### # configuration # INIT_PROG="/sbin/syslog-ng" # Full path to daemon INIT_OPTS="" # options passed to daemon PATH=/bin:/sbin:/usr/bin:/usr/sbin INIT_NAME=`basename "$INIT_PROG"` # Uncomment this if you are on Redhat and think this is useful # # . /etc/sysconfig/network # # if [ ${NETWORKING} = "no" ] # then # exit 0 # fi RETVAL=0 umask 077 ulimit -c 0 # See how we were called. case "$1" in start) export TZ=UCT echo -n "Starting $INIT_NAME: " daemon --check $INIT_PROG "$INIT_PROG $INIT_OPTS" RETVAL=$? echo -n "Starting Kernel Logger: " [ -x "/sbin/klogd" ] && daemon klogd echo [ $RETVAL -eq 0 ] && touch "/var/lock/subsys/${INIT_NAME}" ;; stop) echo -n "Stopping $INIT_NAME: " killproc $INIT_PROG RETVAL=$? echo -n "Stopping Kernel Logger: " [ -x "/sbin/klogd" ] && killproc klogd echo [ $RETVAL -eq 0 ] && rm -f "/var/lock/subsys/${INIT_NAME}" ;; status) status $INIT_PROG RETVAL=$? ;; restart|reload) $0 stop $0 start RETVAL=$? ;; *) echo "Usage: $0 {start|stop|status|restart|reload}" exit 1 esac exit $RETVAL ********************************END OF FILE /etc/rc.d/init.d/syslog-ng Disable the default syslog daemon installed by RedHat. use chkconfig to get rid of it's sysVinit links start up syslog-ng! use chkconfig to make sure that the proper SysVinit links are created and that syslog-ng is configured to be started when the box is. Also use chkconfig to make sure that postgresql is configured to start when the system is. Copy /var/lib/pgsql/data/pg_hba.conf to /var/lib/pgsql/data/pg_hba.conf.orig Edit /var/lib/pgsql/data/pg_hba.conf so that it contains the following lines: **************BEGIN************** local syslog-ng trust admins local all md5 host all 172.16.0.0 255.240.0.0 md5 host all 127.0.0.1 255.255.255.255 md5 *************END****************** echo "postgres" > /var/lib/pgsql/data/admins Make sure that the following lines are uncommented in /var/lib/pgsql/data/postgresql.conf port = 5432 tcpip_socket = true fsync = false shared_buffers=256 If you are not going to monitor the box to make sure that the log files under /var/log and /var/lib/pgsql/syslog don't grow too big then you should write some scripts to clean them up automatically. I plan on doing this eventually, but at this stage in the development of the system I want to watch it manually until I figure out what is going on. Now lets reboot the box and make sure of a few things. So far when the box boots only sshd ntpd bind postgresql (postmaster is the network listener) syslog-ng should be listening on the network NTP should sync up with the time servers. Bind should be forward only and the local system should resolv from itself. SSH & SCP should be accessible from the network. cron should be running. postmaster should be accepting connections from other psql boxes. Now, run "su - postgres" and run the command: "createdb syslog-ng" Then run "psql -U postgres -d syslog-ng" You should now be at an SQL terminal prompt, and you need to run the following commands: CREATE sequence msg_seq_num; CREATE TABLE msg_table ( msg_rcv_time timestamp, msg_sent_time timestamp, hostname varchar(256), msg_facility varchar(16), msg_priority varchar(16), msg_text text, msg_id integer default nextval('msg_seq_num') ); ALTER USER postgres with encrypted password 'enter password here' \q Now create the file called /var/lib/pgsql/syslog/run-syslog2pgsql-insert.sh with the content: **************************************BEGIN FILE ***************************** #!/bin/bash # # /var/lib/pgsql/run-syslog2pgsql-insert.sh # 23-April-2002 by Ben Russo # # This script is intended to be called by cron. # This script should never exit, it runs in a loop. # The first thing it should do is check to see that # if there is another instance already running. # # running this script every minute should work pretty good. # # LOGFILE=/var/lib/pgsql/syslog/syslog2pgsql-insert.log export TZ=UCT if [ -f /var/lib/pgsql/syslog/.insert.lockfile ] then OLDPID=`cat /var/lib/pgsql/syslog/.insert.lockfile` NUMPROCS=`ps -e | grep $OLDPID | grep run-syslog2pg | wc -l` if [ $NUMPROCS -eq 1 ] then exit 0 fi fi echo $$ > /var/lib/pgsql/syslog/.insert.lockfile while true do FILELIST=`find $DATADIR -name "fulllog.2[0-9][0-9][0-9].[0-1][0-9].[0-3][0-9].[0-2][0-9].[0-5][0-9].[0-6][ 0-9]"` usleep 999997 for i in $FILELIST do cat $i | psql -U postgres -d syslog-ng >> $LOGFILE 2>&1 DATE=`date` echo "========= $DATE finished $i" >> $LOGFILE rm -f $i done SLPID=`pidof syslog-ng` done ***************************************END FILE********************************* Make sure that everything under /var/lib/pgsql/ is owned by postgres. Add the following line to the postgres users crontab: * * * * * /var/lib/pgsql/syslog/run-syslog2pgsql-insert.sh >> /var/lib/pgsql/syslog/syslog2pgsql-insert.log 2>&1 Next, install the PsqlODBC driver on your windows desktop PC and install the "pgadmin" utility. Open your control panel Open the ADMINISTRATIVE TOOLS sub-panel Double click on the "DATA SOURCES (ODBC)" Icon Select the System DSN tab from the window that appears. Click on the "ADD" button. Select PostgreSQL Enter "syslog-ng" (or whatever the name of the database was that you created) Enter the host name of your database server The port should be 5432 Your User name can be "postgres" if you are the admin or "guest" (we will create that user soon enough). and the database password for the account name you picked. The password for "guest" should be "guest" Click OK, click OK again, close your control panel windows. Now you can run PGADMIN from the windows start menu ICON. In this utility you can add users and groups and set permissions for the tables and columns. You can use the query wizard to generate and save queries and direct their output to Excell, HTML, TXT or Screen. Create the "guest" "guest" user after logging in as the postgres user. Also create the guest account. Right click on your msg_table and select properties, and on the Security tab give the guest group. Give the guest group the ability to "SELECT" only. Now open up MS Access, open a blank database. >From the FILE menu select GET EXTERNAL DATA, LINK TABLES and in the filebrowser window that pops up you need to scroll down in the "FILES OF TYPE" window to ODBC Databases() Then in the "Select Data Sources" window that appears go to the "Machine Data Source" window and scroll down to PostgreSQL Then select the msg_table and click "OK" Then select the "oid" field (or the "msg_id" field) as your Unique record Identifier and click OK. Now you can use MS-Access to do queries and searches and reports.

1 0

syslog-ng and AIX
by Gehring, Andrew x66132 25 Apr '02

25 Apr '02

Has anyone gotten syslog-ng to work with the SRC (System Resource Controller) on AIX. Since syslog-ng changes process ID after it starts up, SRC thinks it is no longer running... Thanks, Andrew

3 3

template() usage with non-file() output
by Tycho Fruru 25 Apr '02

25 Apr '02

Hello all, Apparently, templates are not (yet ?) supported for non-file output methods, which is too bad for me (wanting to use templates with an external program() or tcp forwarding) :( I've looked rapidly at the code but it seems that template functionality is part of the file affile.c ... so perhaps it will not be easy to extract this and make a generic template mechanism. I would like to know whether anyone of you guys already have written or are planning a patch to include this functionality (which would of course make syslog-ng even better than it is today :-) Cheers, Tycho -- Tycho Fruru tycho.fruru(a)conostix.com "Prediction is extremely difficult. Especially about the future." - Niels Bohr

2 1

Flush message buffer
by Jerome Peducasse 25 Apr '02

25 Apr '02

When a program sends (unfortunaly) a line with '\n' such as "part1\npart2", syslog-ng writes part1 in appropriate destination but when the next message is received, it is "polluted" by part2 of previous message and it losts its facility/priority. For sample: [root@peducasse log]# logger -psyslog.info "Test #1 > Test #2" [root@peducasse log]# logger -psyslog.info "Test #3" condensed strace output: read(3, "<46>Apr 25 17:02:53 jerome: Test #1\nTest #2", 2048) = 43 write(4, "Apr 25 17:02:53 peducasse [syslog.info] jerome jerome: Test #1\n", 63) = 63 read(3, "<46>Apr 25 17:02:56 jerome: Test #3", 2041) = 35 write(14, "Apr 25 17:02:56 peducasse Test #2<46>Apr 25 17:02:56 jerome: Test #3\n", 69) = 69 Thanks for any help. -- Jerome Peducasse

1 0

syslog-ng 1.5.16 released
by Balazs Scheidler 25 Apr '02

25 Apr '02

Hi, I have released syslog-ng 1.5.16 with the following NEWS entry: News for the 1.5.16 release Fri, 12 Apr 2002 09:42:28 +0200 Changes: * added log_prefix support for file sources (for adding 'kernel: ' prefix to messages from /proc/kmsg) * fixed the internal DNS cache, so now it really works * fixed localip() and localport() directives for afinet destinations (they erroneously changed the destination address) * Detect O_LARGEFILE on the system and use it if available * Never close fds 0, 1, 2 and, use /dev/null for 0 and 1, and keep 2 open for messages during reinitialization * Added UNIXTIME, R_UNIXTIME, S_UNIXTIME macros to templates and filenames * Fixed TCP wrapper support. Our webserver is currently down, but as soon as it comes back up, I'll upload this release to the usual place: http://www.balabit.hu/en/downloads/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

RE: [syslog-ng]AIX 4.3.3 and pipe problem?
by Michael Earls 25 Apr '02

25 Apr '02

i am not sure how to do that, can u explain how michael -----Original Message----- From: bazsi(a)balabit.hu Sent: Thursday, April 25, 2002 5:04 AM To: <syslog-ng(a)lists.balabit.hu> Cc: <AGehring(a)bis.adp.com> Subject: Re: [syslog-ng]AIX 4.3.3 and pipe problem? On Wed, Apr 24, 2002 at 09:07:07AM 0400, Michael Earls wrote: > i am running the pkg from debian /testing, 1.5.15. and i am trying to > run this command. i created my fifo pipe and i am not seeing anything > being posted there. > > what am i doing wrong? > > destination d_mysql { > pipe("/tmp/mysql.pipe" > template("INSERT INTO logs (host, facility, priority, level, tag, > date, > time, program, msg) VALUES ('$HOST', > '$FACILILITY','$PRIORITY',$LEVEL','$TAG','$YEAR $MONTH $DAY','$HOUR:$MIN:$SEC','$PROGRAM','$MSG');\n") > template escpae(yes)); > }; > log { source(net); destination(d_mysql); > }; Can you strace the process as it receives a single message? Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog ng maillist syslog ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog ng

1 0

RE: [syslog-ng]AIX 4.3.3 and pipe problem?
by Michael Earls 25 Apr '02

25 Apr '02

i am running the pkg from debian /testing, 1.5.15. and i am trying to run this command. i created my fifo pipe and i am not seeing anything being posted there. what am i doing wrong? destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ('$HOST', '$FACILILITY','$PRIORITY',$LEVEL','$TAG','$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC','$PROGRAM','$MSG');\n") template-escpae(yes)); }; log { source(net); destination(d_mysql); }; thanks michael -----Original Message----- From: bazsi(a)balabit.hu Sent: Wednesday, April 24, 2002 3:33 AM To: <syslog-ng(a)lists.balabit.hu> Cc: <AGehring(a)bis.adp.com> Subject: Re: [syslog-ng]AIX 4.3.3 and pipe problem? On Tue, Apr 23, 2002 at 12:43:56PM 0400, Michael Earls wrote: > i have not seen that on the AIX but i have seen that on linux ver > 1.5.15, the pipe does not work. I've just tested my CVS version and it works. (it has a few changes against 1.5.16) Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog ng maillist syslog ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog ng

2 1

syslog-ng dying after kill -HUP
by Robert Berlinger 25 Apr '02

25 Apr '02

Now experimenting with 1.5.16. Works OK except it consistently dies with a Segmentation Fault after a kill -HUP. This is on a RH 7.2 system. I ran it with the -d option, and the fault occurs after printing io.c: listening on fd 3 io.c: Preparing fd 4 for reading io.c: listening on fd 5 Segmentation fault Any pointers would be greatly appreciated.

3 2

RE: [syslog-ng]Random Directories
by Tom Horan 25 Apr '02

25 Apr '02

I had a similar problem on my host creating a 'last' directory. So I changed keep_hostname to (no), afaik this means that syslog-ng adds the hostname into the message incase the sending server hasnt done it. It started logging these type of messages to the correct server. Hope it helps, Tom -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: 24 April 2002 18:47 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Random Directories On Wed, Apr 24, 2002 at 10:32:20AM -0700, Painter, Jennifer wrote: > Directories with names like " Error", " SCSI", "," > > Are showing up in the directory that holds the syslogs for the different hosts that we monitor. > > Has anyone seen these random directories. Any suggestions on how to deal with them. I archive by host, but syslog-ng can only do so much with certain messages. [root@loghost last]# cat /var/log/HOSTS/last/local2/2001/09/14/local220010914 Sep 14 12:21:58 last message repeated 17 times Sep 14 12:21:58 last message repeated 17 times Sep 14 12:21:58 last message repeated 17 times Sep 14 12:21:58 last message repeated 17 times Obviously I have no host named "last", syslog-ng can't second guess the hostname sent when it could be valid. I want a macro taken from gethostbyaddr() instead of from the message contents that could be used to force a valid hostname no matter what. Baszi, could this be done please? It would help all of us who use syslog-ng for log archiving in the filesystem. -- Linux is like an indian's tent: No gates, no windows, and apache inside. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ************************************************************************ This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. http://www.esatbusiness.com Subscribe to the Esat Business Online Magazine: http://www.esatbusiness.com/news/subscribe.asp Subscribe to REALISE - the online magazine from BT Ignite: http://www.btignite.com/realise ************************************************************************

2 1

largefile-problem with linux 2.4.18 / glibc 2.2.4
by Jussi Silvennoinen 24 Apr '02

24 Apr '02

Hello, I'm having a problem with largefile-support with syslog-ng 1.5.16 on redhat 7.2 with all all updates as of April 19 installed. Log-partition is a 300gb hardware raid5 through an AMI Megaraid Elite 1600, filesystem is XFS dated 2002-03-04 with latest userspace-utils installed. Other software installed on the box have no problems with largefile-support. Output of ./configure and make [root@gull syslog-ng-1.5.16]# ./configure creating cache ./config.cache checking for a BSD compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking whether build environment is sane... yes checking for gcc... gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for bison... bison -y checking how to run the C preprocessor... gcc -E checking for flex... flex checking for flex... (cached) flex checking for yywrap in -lfl... yes checking lex output file root... lex.yy checking whether yytext is a pointer... yes checking whether make sets ${MAKE}... (cached) yes checking for ANSI C header files... yes checking for malloc.h... yes checking for unistd.h... yes checking for door.h... no checking for stropts.h... yes checking for sys/strlog.h... no checking for stdarg.h... yes checking for sys/klog.h... yes checking for working const... yes checking whether time.h and sys/time.h may both be included... yes checking for modern utmp... yes checking whether to compile klogctl... yes checking size of short... 2 checking size of int... 4 checking size of long... 4 checking for I_CONSLOG... no checking for O_LARGEFILE... yes checking for working alloca.h... yes checking for alloca... yes checking for vprintf... yes checking for door_create in -ldoor... no checking for select... yes checking for snprintf... yes checking for vsnprintf... yes checking for strerror... yes checking for inet_aton... yes checking for strncpy... yes checking for getutent... yes checking for getopt_long... yes checking for strcasecmp... yes checking for strptime... yes checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking libol version >= 0.3.2... ok updating cache ./config.cache creating ./config.status creating Makefile creating src/Makefile creating src/tests/Makefile creating doc/Makefile creating doc/sgml/Makefile creating contrib/Makefile creating utils/Makefile sed: can't read /usr/local/src/testifoo/syslog-ng-1.5.16/utils/Makefile.in: No such file or directory creating syslog-ng.spec creating src/config.h [root@gull syslog-ng-1.5.16]# make Making all in src make[1]: Entering directory `/usr/local/src/testifoo/syslog-ng-1.5.16/src' cd /usr/local/src/testifoo/syslog-ng-1.5.16 && autoheader make all-recursive make[2]: Entering directory `/usr/local/src/testifoo/syslog-ng-1.5.16/src' Making all in . make[3]: Entering directory `/usr/local/src/testifoo/syslog-ng-1.5.16/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c main.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c sources.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c center.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c filters.c filters.c: In function `do_filter_call': filters.c:342: warning: implicit declaration of function `memcmp' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c destinations.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c log.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c cfgfile.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c cfg-grammar.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c cfg-lex.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c affile.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afsocket.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afunix.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afinet.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afinter.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afuser.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afstreams.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afprogram.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afremctrl.c afremctrl.c: In function `do_handle_afremctrl_dest': afremctrl.c:56: warning: implicit declaration of function `strcmp' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c nscache.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c utils.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c syslog-names.c gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o -lfl /usr/local/lib/libol.a -lnsl make[3]: Leaving directory `/usr/local/src/testifoo/syslog-ng-1.5.16/src' Making all in tests make[3]: Entering directory `/usr/local/src/testifoo/syslog-ng-1.5.16/src/tests' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/testifoo/syslog-ng-1.5.16/src/tests -I../../src -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c test_nscache.c gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o test_nscache test_nscache.o ../nscache.o -lfl /usr/local/lib/libol.a -lnsl make[3]: Leaving directory `/usr/local/src/testifoo/syslog-ng-1.5.16/src/tests' make[2]: Leaving directory `/usr/local/src/testifoo/syslog-ng-1.5.16/src' make[1]: Leaving directory `/usr/local/src/testifoo/syslog-ng-1.5.16/src' Making all in doc make[1]: Entering directory `/usr/local/src/testifoo/syslog-ng-1.5.16/doc' Making all in sgml make[2]: Entering directory `/usr/local/src/testifoo/syslog-ng-1.5.16/doc/sgml' make[2]: Nothing to be done for `all'. make[2]: Leaving directory `/usr/local/src/testifoo/syslog-ng-1.5.16/doc/sgml' make[2]: Entering directory `/usr/local/src/testifoo/syslog-ng-1.5.16/doc' make[2]: Nothing to be done for `all-am'. make[2]: Leaving directory `/usr/local/src/testifoo/syslog-ng-1.5.16/doc' make[1]: Leaving directory `/usr/local/src/testifoo/syslog-ng-1.5.16/doc' Making all in contrib make[1]: Entering directory `/usr/local/src/testifoo/syslog-ng-1.5.16/contrib' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/usr/local/src/testifoo/syslog-ng-1.5.16/contrib' make[1]: Entering directory `/usr/local/src/testifoo/syslog-ng-1.5.16' make[1]: Nothing to be done for `all-am'. make[1]: Leaving directory `/usr/local/src/testifoo/syslog-ng-1.5.16' From this I would assume that it would support largefiles, however it appears it does not. [root@gull syslog-ng-1.5.16]# src/syslog-ng -d io.c: listening on fd 3 io.c: Preparing fd 4 for reading syslog-ng version 1.5.16 starting io.c: Preparing fd 5 for writing io.c: Preparing fd 6 for writing io.c: Preparing fd 7 for writing io.c: Preparing fd 8 for writing io.c: Preparing fd 9 for writing File size limit exceeded [root@gull syslog-ng-1.5.16]# ls -l /data/syslog/mail.log -rw-rw---- 1 root root 2147483647 Apr 18 21:54 /data/syslog/mail.log Any ideas how to proceed solving this problem? I am currently running syslog-ng 1.4.14 on Solaris 8 without any problems regarding largefile-support. -- Jussi

3 3

Re: [syslog-ng]rotation log for syslog-ng
by klaas.vangend＠philips.com 24 Apr '02

24 Apr '02

> Hello, > i am trying to use syslog-ng. > Could anyone brievely explain me how to have rotation log ? > I can find any document about that. Is it possible ? > Haw can i fixe the size of the files, and how can i specifie > the number of files i want ? > Thanks > -- > Jérôme Jerome (sorry, no accents on my keyboard), Syslog-ng in the latest 1.5 versions can handle log rotation in the following way: * use macros to create logs per weekday or monthday * remove a log file if it is older (i.e. not written to) than one week minus 1 day . Example: destination warn { file("/var/log/warn.$WEEKDAY" remove_if_older(432000)); }; filter f_allwarnings { level(warn..emerg); }; log { source(src); source(kernel); filter(f_allwarnings); destination(warn); }; For more advanced log rotation, you will need to use the usual log rotation scripts/daemons. Groetjes, Klaas van Gend

1 0

using pipe results in lost messages?
by Russo, Ben 24 Apr '02

24 Apr '02

Hi, this is my first posting to syslog-ng@lists Syslog-NG is very nice. This is the future of network wide logging. I am using syslog-ng-1.5.16 with no modifications as downloaded from balabit.hu with libol-0.3.2 also with no modifications as downloaded from balabit.hu I am running on RedHat v7.2 with all the latest patches. I compiled syslog-ng with "rpm -tb" to build i386.rpms. I got it set up with a minimum of hassle. Here is my /etc/syslog-ng/syslog-ng.conf file (ln -s /etc/syslog-ng /usr/etc/syslog-ng) ========================================================BEGIN syslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (100); long_hostnames (off); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); time_reap(65536); }; source s_sys { unix-stream ("/dev/log"); internal(); }; source s_udp { udp(); }; destination d_files { file("/var/log/syslog-ng/$HOST/$FACILITY.$LEVEL" template("$ISODATE $HOST $FACILITY $PRIORITY $PROCESS $MSG\n")); }; destination d_pipe { pipe("/var/lib/pgsql/syslog-ng.pipe" template("INSERT INTO testtable VALUES $ '$R_ISODATE', '$S_ISODATE', '$HOST', '$FACILITY', '$PRIORITY', '$MSG'$\;\n") template_escape(yes)); }; log { source(s_sys); source(s_udp); destination(d_files); }; log { source(s_sys); source(s_udp); destination(d_pipe); }; ==================================================================END OF FILE Then I have a script that runs: while true do read INSERT < /var/lib/pgsql/syslog-ng.pipe echo $INSERT > /tmp/outfile done And I have a testfile /tmp/wholelog with 1000 lines in it. I run "logger -p user.info -f /tmp/wholelog" at the end of the run I have 942 messages in /var/log/syslog-ng/testbox.tnsi.com/user.info and I have 332 lines in /tmp/outfile Can anyone tell me how I can tune this up so that I don't loose so many messages? Eventually I will have 100 hosts in my data center redirecting logs to this box over a 100Mb/s full duplex switched network and I will replace the script that does reads with one that redirects input to psql BTW, I have already tested a script that does: cat /var/lib/pgsql/syslog-ng.pipe | psql -U dbauser -d test And it works as long as I don't send more than about 20 messages per second. Although there are some "template_escape" problems I have seen that cause me to loose a few messages here and there... I'm not that worried about it. But losing 5% of the messages just on the localhost seems a little odd? It should be closer to 0% right? One other question I have (after reading as much of src/affile.c as I could understand) Is there a way to output the priority and facility as seperate integer values rather than as a bitshifted combined 2 digit hex value? -Ben.

2 1

RE: [syslog-ng]AIX 4.3.3 and pipe problem?
by Michael Earls 24 Apr '02

24 Apr '02

i have not seen that on the AIX but i have seen that on linux ver 1.5.15, the pipe does not work. -----Original Message----- From: AGehring(a)bis.adp.com Sent: Monday, April 22, 2002 12:31 PM To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng]AIX 4.3.3 and pipe problem? I'm running syslog ng on AIX 4.3.3 and while it works fine for system log calls, it doesn't seem to connect to a defined pipe and send information to it based on a logger call... below is a test conf file that I'm using. Send a message with logger is shows up in the d_mesg, but not to the d_pipe (Netcool is attached to the pipe. lsof shows the /var/adm/messages file being open, and again not the pipe... source s_sys { unix dgram ("/dev/log"); internal (); } destination d_mesg { file("/var/adm/messages"); }; destination d_pipe { pipe("/var/adm/mypipe"); }; log { source (s_sys); destination (d_mesg); destination (d_pipe); }; Any one seen this, or something like it? TIA, Andrew

2 1

IPtables Problem with syslog-ng
by Kaan Saldiraner 23 Apr '02

23 Apr '02

I have the latest STABLE version of syslog-ng. I want this machine to become my Log server for 5 or 6 machines. I am having trouble with iptables logging on the local machine. It doesn't log through syslog-ng. And also i would like to have a look at a sample config file for syslog-ng configured to be a Log Server. if you can provide this to me.. it will be great. Thank you in advance... Kaan Saldiraner Steltor Inc. (514)733-8500 x6503 www.steltor.com

1 0

Problems with Iptables Logging
by Kaan Saldiraner 23 Apr '02

23 Apr '02

I have the latest STABLE version of syslog-ng. I want this machine to become my Log server for 5 or 6 machines. I am having trouble with iptables logging on the local machine. It doesn't log through syslog-ng. And also i would like to have a look at a sample config file for syslog-ng configured to be a Log Server. if you can provide this to me.. it will be great. Thank you in advance... Kaan Saldiraner Steltor Inc. (514)733-8500 x6503 www.steltor.com

1 0

No indication of facility/level on AIX 4.3.3 using syslog-ng 1.4. 14
by Gehring, Andrew x66132 23 Apr '02

23 Apr '02

Is there something special I need to define or configure to have syslog-ng on AIX (4.3.3) write the facility/severity as part of the messages? On solaris we saw [facility/severity] written with each messages, but we don't get this on AIX... Did I miss something while configuring/compiling? Thanks, Andrew

3 4

AIX 4.3.3 and pipe problem?
by Gehring, Andrew x66132 23 Apr '02

23 Apr '02

I'm running syslog-ng on AIX 4.3.3 and while it works fine for system log calls, it doesn't seem to connect to a defined pipe and send information to it based on a logger call... below is a test conf file that I'm using. Send a message with logger is shows up in the d_mesg, but not to the d_pipe (Netcool is attached to the pipe. lsof shows the /var/adm/messages file being open, and again not the pipe... source s_sys { unix-dgram ("/dev/log"); internal (); } destination d_mesg { file("/var/adm/messages"); }; destination d_pipe { pipe("/var/adm/mypipe"); }; log { source (s_sys); destination (d_mesg); destination (d_pipe); }; Any one seen this, or something like it? TIA, Andrew

2 1

rotation log for syslog-ng
by J�r�me Tournier 23 Apr '02

23 Apr '02

Hello, i am trying to use syslog-ng. Could anyone brievely explain me how to have rotation log ? I can find any document about that. Is it possible ? Haw can i fixe the size of the files, and how can i specifie the number of files i want ? Thanks -- Jérôme

1 0