- syslog-ng - lists.balabit.hu

Re: Im sorry Im writing direct to you but the list is not working Re: [syslog-ng]filtering with regexp
by Balazs Scheidler 23 Apr '02

23 Apr '02

On Mon, Apr 22, 2002 at 12:02:05PM -0700, mar tin wrote: > Im sorry Im writing direct to you but the list is not > working.. I get all the messages back! > > now I've the lines duplicated: > I have them in auth.log and cron.log! > how can I tell syslog to put them only in cron.log? syslog-ng forwards messages to all matching destinations. you have two options to change this behaviour: * use filters that match only the lines you are interested in * use the flags(fallback) feature of syslog-ng 1.5.x > > --- Balazs Scheidler <bazsi(a)balabit.hu> wrote: > > On Thu, Apr 18, 2002 at 01:06:32PM -0700, mar tin > > wrote: > > > Hello :) > > > When cron runs, it sends the following lines > > > Apr 18 16:50:01 martinII PAM_unix[26181]: (cron) > > > session opened for user smmsp by (uid=0) > > > Apr 18 16:50:01 martinII PAM_unix[26182]: (cron) > > > session opened for user runa by (uid=0) > > > Apr 18 16:50:01 martinII PAM_unix[26183]: (cron) > > > session opened for user runa by (uid=0) > > > Apr 18 16:50:02 martinII PAM_unix[26181]: (cron) > > > session closed for user smmsp > > > Apr 18 16:50:25 martinII PAM_unix[26183]: (cron) > > > session closed for user runa > > > Apr 18 16:50:27 martinII PAM_unix[26182]: (cron) > > > session closed for user runa > > > > > > I want to filter those lines and send them to > > other > > > files, so I did: > > > > > > filter f_cron2{match("(cron) session opened");}; > > > log { source(src); filter(f_cron2); > > > destination(cron);}; > > > > > > but it sends the lines to auth.log! > > > > > > what am I doing wrong? > > > > match() expects an extended regular expression, thus > > '(' and ')' are > > interpreted as special characters. You need to > > escape them via '\', but as > > this is the escape character in the string, you need > > to double the backslash > > like: > > > > match("\$cron\$ session opened") > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C > > 0944 9CFD 804E C82C 8EB1 > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > __________________________________________________ > Do You Yahoo!? > Yahoo! Games - play chess, backgammon, pool and more > http://games.yahoo.com/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

program destination prob ?
by Thomas Ackermann 19 Apr '02

19 Apr '02

hy! i'm using syslog-ng to send remote log messages over an stunnel to a log server. everything's running quite fine, besides one little problem i have.. i'm starting the stunnel with program("/usr/sbin/stunnel -r 192.168.3.125:6543 -c"); when the stunnel is killed or quits because of a bad connection, syslog-ng doesn't even bother 'bout trying to restart it. is that a wanted behaviour and, or, is there a way to gat syslog-ng to respawn processes called with program() ? thx, thomas

4 4

Re: [syslog-ng]Different messages being logged
by Michael Renner 19 Apr '02

19 Apr '02

At 15:46 19.04.2002 +0100, you wrote: >log { source(s_sys); filter(f_filter1); destination(d_cons); }; >log { source(s_sys); filter(f_filter2); destination(d_mesg); }; >log { source(s_sys); filter(f_filter3); destination(d_auth); }; >log { source(s_sys); filter(f_filter4); destination(d_mail); }; >log { source(s_sys); filter(f_filter5); destination(d_mlal); }; >log { source(s_sys); filter(f_filter6); destination(d_spol); }; > > >The syslog.conf from my HPUX box has the following line added >*.info;mail.none @central-syslog-server > >I figure its got something to do with filters, but I dont know where to >start. Basically I want everything logged and then I'll start deciding what >to filter out. Maybe there are messages sent on facilities which aren't mentioned in your filters (like local1..7), try putting a "catch-everything-which-hasnt-been-logged-yet" rule somewhere in there. In 1.5.* it's something like log { source(s_sys); destination(leftover); flags(fallback); }; unfortunately i can't remember the syntax for 1.4.* anymore. You should also use something like "*.* @central-syslog-server" on the syslogd's if you really want all messages from the hpux'n. mfg/best regards -- Michael Renner Junior System Engineer Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at support(a)inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699

1 0

Different messages being logged
by Tom Horan 19 Apr '02

19 Apr '02

Hi, I'm running syslog-ng 1.4.14 on a RedHat 7 box, using it to log messages from a mixture of 10.20 and 11.0 HP-UX boxes. The HP boxes are using their own syslog here. I've got messages coming in from the hosts fine, but some stuff isnt coming through - ie syslog on the local box has more messages that the log on the central syslog-ng server. In particular is anything coming from vmunix. Here is what my config file looks like, it is taken from a sample config with just the udp added in and the $HOST variable added in for paths. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (no); }; source s_sys { unix-stream ("/dev/log"); internal(); udp(ip(10.16.6.102) port(51 4)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/syslog/$HOST/messages"); }; destination d_auth { file("/var/syslog/$HOST/secure"); }; destination d_mail { file("/var/syslog/$HOST/maillog"); }; destination d_spol { file("/var/syslog/$HOST/spooler"); }; destination d_boot { file("/var/syslog/$HOST/boot.log"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; The syslog.conf from my HPUX box has the following line added *.info;mail.none @central-syslog-server I figure its got something to do with filters, but I dont know where to start. Basically I want everything logged and then I'll start deciding what to filter out. Can anyone help me out here ? Thanks, Tom ************************************************************************ This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. http://www.esatbusiness.com Subscribe to the Esat Business Online Magazine: http://www.esatbusiness.com/news/subscribe.asp Subscribe to REALISE - the online magazine from BT Ignite: http://www.btignite.com/realise ************************************************************************

1 0

unsubscribe
by Chris Brown 19 Apr '02

19 Apr '02

Unsubscribe chris(a)nbs.co.uk

1 0

filtering with regexp
by mar tin 19 Apr '02

19 Apr '02

Hello :) When cron runs, it sends the following lines Apr 18 16:50:01 martinII PAM_unix[26181]: (cron) session opened for user smmsp by (uid=0) Apr 18 16:50:01 martinII PAM_unix[26182]: (cron) session opened for user runa by (uid=0) Apr 18 16:50:01 martinII PAM_unix[26183]: (cron) session opened for user runa by (uid=0) Apr 18 16:50:02 martinII PAM_unix[26181]: (cron) session closed for user smmsp Apr 18 16:50:25 martinII PAM_unix[26183]: (cron) session closed for user runa Apr 18 16:50:27 martinII PAM_unix[26182]: (cron) session closed for user runa I want to filter those lines and send them to other files, so I did: filter f_cron2{match("(cron) session opened");}; log { source(src); filter(f_cron2); destination(cron);}; but it sends the lines to auth.log! what am I doing wrong? __________________________________________________ Do You Yahoo!? Yahoo! Tax Center - online filing with TurboTax http://taxes.yahoo.com/

2 1

Macro $MSG and '\'
by Jerome Peducasse 18 Apr '02

18 Apr '02

Hello, When I use template("$DATE $HOST [$FACILITY.$LEVEL] $PROGRAM $MSG\n"), messages like: Apr 16 16:02:28 xml-indexer1.conso.fr.ke.echo/xml-indexer1-0-0.conso.fr.ke.echo /ke/bin/afp.kelight[29524]: failed to init index '/ke/data/afp/group_by' in enum echo::keret echo::XmlServer::start(const char *):XmlServer.cc:235 become Apr 16 16:17:27 xml-indexer1.conso.fr.ke.echo [local0.err] /ke/bin/afp.kelight /ke/bin/afp.kelight[9294]: failed to init index \'/ke/data/afp/group_by\' in enum echo::keret echo::XmlServer::start(const char *):XmlServer.cc:235 ('/ke/data/afp/group_by' become \'/ke/data/afp/group_by\') Bye. -- Jerome Peducasse

2 2

FW:
by Robert Berlinger 18 Apr '02

18 Apr '02

Hi, Getting the following error sporadically: Apr 18 10:24:41 logserver syslog-ng[27078]: Error accepting AF_UNIX connection, opened connections: 4294967295, max: 100 There certainly isn't that many open connections. Running 1.4.14 on Redhat 7.2. Any pointers would be appreciated.

1 0

Lost of facility/level
by Jerome Peducasse 18 Apr '02

18 Apr '02

Hi, I'm using syslog-ng 1.5.15 and sometimes (probably during message burst), messages lost their facility/level and are logged with user/notice. Message format becomes: Mar 29 11:35:50 w3search3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:427 <130>Mar 29 11:35:50 w3search[19816]: read Context failed on socket=3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:434 instead of: Mar 29 11:32:07 w3search3 w3search[19817]: read Context failed on socket=3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:434 General log_fifo_size is set to 1000 and is set to 10000 for appropriate filter of this message: destination d_applicatif { file("/ke/logs/ke.log" owner(test) group(test) log_fifo_size(10000) ); }; filter f_applicatif { facility(local0); }; log { source(s_sys); filter(f_applicatif); destination(d_applicatif); destination(d_loghost_applicatif); flags(final); }; Any Idea ? -- Jerome Peducasse

2 15

Problem compiling on Solaris 8 (sparc)
by dcntrnoc＠cmp.com 18 Apr '02

18 Apr '02

Hi all, I'm trying to compile syslog-ng version 1.5.16 with gcc version 3.0.3. Yes, libol 0.3.2 is installed. I am receiving the following error. Any help would be appreciated. . . . gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c: In function `stream_read_callback': afstreams.c:148: too few arguments to function `make_log_info' make[3]: *** [afstreams.o] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng/syslog-ng-1.5.16/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng/syslog-ng-1.5.16/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng/syslog-ng-1.5.16/src' make: *** [all-recursive] Error 1 Thanks in advance, Sharon. __________________________________________________________________________________________ Any views or opinions are solely those of the author and do not necessarily represent those of CMP Media. The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. If you are not the intended recipient of this message please do not read, copy, use or disclose this communication and notify the sender immediately. It should be noted that any review, retransmission, dissemination or other use of, or taking action or reliance upon, this information by persons or entities other than the intended recipient is prohibited. __________________________________________________________________________________________

3 2

RE: [syslog-ng]Installation Error
by Tom Horan 17 Apr '02

17 Apr '02

Did you get libol and installed that first ? It should be on the download page along with syslog-ng. ./thos -----Original Message----- From: Kaan Saldiraner [mailto:kaans@steltor.com] Sent: 17 April 2002 15:19 To: syslog-ng(a)lists.balabit.hu Cc: kaans(a)steltor.com Subject: [syslog-ng]Installation Error Hello Everyone, I just tried to compile syslog-ng on a mandrake 8.2 machine and at make i get these errors.. What do you think? Thanks --------------------------- [root@superfly syslog-ng-1.4.14]# make Making all in src make[1]: Entering directory `/tmp/syslog-ng-1.4.14/src' make all-recursive make[2]: Entering directory `/tmp/syslog-ng-1.4.14/src' Making all in . make[3]: Entering directory `/tmp/syslog-ng-1.4.14/src' gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.4.14/src -I. -O2 -Wall -I/usr /include/libol -D_GNU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33:18: list.h: No such file or directory main.c:29:20: format.h: No such file or directory main.c:30:20: werror.h: No such file or directory main.c:31:19: queue.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/tmp/syslog-ng-1.4.14/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/tmp/syslog-ng-1.4.14/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/tmp/syslog-ng-1.4.14/src' make: *** [all-recursive] Error 1 Kaan Saldiraner Steltor Inc. (514)733-8500 x6503 www.steltor.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ************************************************************************ This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. http://www.esatbusiness.com Subscribe to the Esat Business Online Magazine: http://www.esatbusiness.com/news/subscribe.asp Subscribe to REALISE - the online magazine from BT Ignite: http://www.btignite.com/realise ************************************************************************

1 0

Installation Error
by Kaan Saldiraner 17 Apr '02

17 Apr '02

Hello Everyone, I just tried to compile syslog-ng on a mandrake 8.2 machine and at make i get these errors.. What do you think? Thanks --------------------------- [root@superfly syslog-ng-1.4.14]# make Making all in src make[1]: Entering directory `/tmp/syslog-ng-1.4.14/src' make all-recursive make[2]: Entering directory `/tmp/syslog-ng-1.4.14/src' Making all in . make[3]: Entering directory `/tmp/syslog-ng-1.4.14/src' gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.4.14/src -I. -O2 -Wall -I/usr /include/libol -D_GNU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33:18: list.h: No such file or directory main.c:29:20: format.h: No such file or directory main.c:30:20: werror.h: No such file or directory main.c:31:19: queue.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/tmp/syslog-ng-1.4.14/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/tmp/syslog-ng-1.4.14/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/tmp/syslog-ng-1.4.14/src' make: *** [all-recursive] Error 1 Kaan Saldiraner Steltor Inc. (514)733-8500 x6503 www.steltor.com

1 0

[PATCH] make log_msg_size tunable
by Balazs Scheidler 17 Apr '02

17 Apr '02

Hi, The attached patch makes the maximum length of a log message tunable as a global option. Testers welcome. Usage: options { log_msg_size(8192); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 1

chain_hostnames and template
by Jerome Peducasse 16 Apr '02

16 Apr '02

Hello, How can I use template and keep chain_hostname in log format ? In documentation, I don't see macro allows it. Thx. -- Jerome Peducasse

2 1

Syslog-ng Reliability
by Victor 15 Apr '02

15 Apr '02

Well, I got syslog-ng setup and running. Runs great. I have to say, this is a realy nice way of doing logging. Major kudos to developers. a few questions: 1. How reliable is network server operation of Syslog-ng under heavy load? I am running remote servers using tcp() and anticipate a lot of throughput. Will syslog-ng not drop stuff like syslogd does? 2. log_fifo_size(100) is this in bytes or kbytes or what? Is this a memory buffer before a write is done? 3. I didn't find the documentation in the man page for variables like $YEAR, $MONTH, $HOST, etc. Where is the list of these? 4. Any idea when compress(on) function will be implemented?

2 1

Installing Syslog-NG
by Victor 13 Apr '02

13 Apr '02

Hi, I have a linux system and I want to try to install Syslog-ng to stream apache logs from one box to a central box (since regular syslog is not reliable) How do I install syslog-ng on a new system? It seems to be running syslogd and klogd. Do I just shutdown syslogd only? Or both? Or does syslogd-ng run alongside the two? Could you also post an example of a config file that mimics the /var/log/maillog,kernlog, etc type of logging in a syslog-ng server config setup? Thanks for any help. P.S. Is there perhaps a howto dealing with installation of Syslog-ng on a running system? Thanks

1 0

RE: [syslog-ng]syslog-ng 1.5.16 released
by Clausing, James A (Jim), SOLCM 12 Apr '02

12 Apr '02

It was solaris 8, configure options don't really matter (in my case, I didn't use any, just ./configure), the problem is that going from 1.5.15 to 1.5.16, the make_log_info function now takes 3 arguments rather than 2 and this call only had 2. I'm using gcc-2.95.3 (same problem with 3.0.4). The compiler complained about mismatch in number of arguments. ---Jim -----Original Message----- From: Ed Ravin [mailto:eravin@panix.com] Sent: Friday, April 12, 2002 2:51 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng 1.5.16 released "Clausing, James A (Jim), SOLCM" writes: > > syslog-ng 1.5.16 didn't build for me without the following patch. I'm not > sure what the prefix should be so I just used NULL. And what operating system and platform are you running? What were your arguments to ./configure? > --- syslog-ng-1.5.16/src/afstreams.c Sun Jul 8 17:04:21 2001 > +++ syslog-ng-1.5.16-patched/src/afstreams.c Fri Apr 12 18:09:01 2002 > @@ -145,7 +145,7 @@ > > length = eol - bol; > if (length) { > - li = make_log_info(length, bol); > + li = make_log_info(length, bol, NULL); > li->pri = pri; > HANDLE_LOG(self->pipe, li); > } _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]syslog-ng 1.5.16 released
by Clausing, James A (Jim), SOLCM 12 Apr '02

12 Apr '02

syslog-ng 1.5.16 didn't build for me without the following patch. I'm not sure what the prefix should be so I just used NULL. --- syslog-ng-1.5.16/src/afstreams.c Sun Jul 8 17:04:21 2001 +++ syslog-ng-1.5.16-patched/src/afstreams.c Fri Apr 12 18:09:01 2002 @@ -145,7 +145,7 @@ length = eol - bol; if (length) { - li = make_log_info(length, bol); + li = make_log_info(length, bol, NULL); li->pri = pri; HANDLE_LOG(self->pipe, li); } -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, April 12, 2002 6:34 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.5.16 released Hi, I have released syslog-ng 1.5.16 with the following NEWS entry: News for the 1.5.16 release Fri, 12 Apr 2002 09:42:28 +0200 Changes: * added log_prefix support for file sources (for adding 'kernel: ' prefix to messages from /proc/kmsg) * fixed the internal DNS cache, so now it really works * fixed localip() and localport() directives for afinet destinations (they erroneously changed the destination address) * Detect O_LARGEFILE on the system and use it if available * Never close fds 0, 1, 2 and, use /dev/null for 0 and 1, and keep 2 open for messages during reinitialization * Added UNIXTIME, R_UNIXTIME, S_UNIXTIME macros to templates and filenames * Fixed TCP wrapper support. Our webserver is currently down, but as soon as it comes back up, I'll upload this release to the usual place: http://www.balabit.hu/en/downloads/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 2

syslog-ng-1.5.15 with tcp-wrapper support
by Stefan M. Brandl 12 Apr '02

12 Apr '02

Hi, I tried to compile syslog-ng-1.5.15 with tcp-wrapper support but had no success. First I had to patch afinet.c with the patch mentioned in http://lists.balabit.hu/pipermail/syslog-ng/2002-February/002962.html But when compiling I get: make[3]: Entering directory `/root/syslog-ng-1.5.15/src' make_class <afinet.c >afinet.c.xT Warning: use of macro doesn't match definition (syntax-rules '() ((let-and (expr) clause clauses ...) (and expr (let-and clause clauses ...))) ((let-and (name expr) clause clauses ...) (let ((name expr)) (and name (let-and clause clauses ...)))) ((let-and expr) expr)) Error: attempt to call a non-procedure ('syntax-error '(#{Name let-and} ((pair? expr)) (op-matches (match # #)) (arg-matches (match # #)) (append op-matches arg-matches)) '#{Procedure 2489 (unnamed in make-name-generator in names)} '#{Procedure 2486 (unnamed in make-keyword-comparator in names)}) make[3]: *** [afinet.c.x] Error 1 make[3]: Leaving directory `/root/syslog-ng-1.5.15/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/syslog-ng-1.5.15/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/root/syslog-ng-1.5.15/src' make: *** [all-recursive] Error 1 Is this a know problem or am I missing something? Regards Stefan

3 2

Re: [syslog-ng]syslog-ng-1.5.15 with tcp-wrapper support
by Stefan M. Brandl 12 Apr '02

12 Apr '02

Ed Ravin eravin(a)panix.com wrote: > This is a bug of some kind in make_class, which comes with the lib-ol > package (and is probably installed in your /usr/local/bin). A kind soul > on the syslog-ng list turned in this patch to fix make_class (you'll > want to edit by hand or apply with "patch -l" since I'm screwing up > the whitespace by posting it this way). > > --- /usr/local/bad/make_class Wed Feb 6 15:59:34 2002 > +++ ./make_class Wed Mar 6 12:10:32 2002 > @@ -19,7 +19,7 @@ > ;; FIXME: Turn this into a scheme48 module > > (define-syntax let-and > - (syntax-rules '() > + (syntax-rules () > ((let-and (expr) clause clauses ...) > (and expr (let-and clause clauses ...))) > ((let-and (name expr) clause clauses ...) Great, this works. Thanks Stefan

1 0

Newbie: System inter-process communication ?
by Jacques.Riopel＠equant.com 11 Apr '02

11 Apr '02

Hi all. Using syslog-ng version 1.4.15. I'm trying to set up a network of machines all running syslog-ng in a testbed. Some machines run Solaris 5.8, others are Sun-Cobalts runing a flavor of Linux. I have successfully compiled when necessary and replaced all the syslogd with syslog-ng on my 4 test machines. Now the hard part is making them all talk to each other, and discovering how to set them to use different ports and TCP vs UDP in some cases. I have the following questions so far: Question 1: Is it possible to specify the upd port to listen on, ie something like "source s_udp { udp (666); };" and then instruct the syslog-ng on the sending machine to use that UDP port as a destination? When I tried the above, I got a parsing error when starting up syslog-ng. My whole test scenario is to have one machine called "A1" at the top level "A", that will listen on port 514 for syslog messages using a TCP connection from machine "B1" at level "B". Machine "B1" is a syslog consolidator, that passes syslog messages to A1 over TCP(514) and receives syslogs from other machines "C1", "C2" on level "C". I want to try to configure machine "C1" to output to machine "B1" using UDP(514), and at the same time have machine "C2" forward its syslogs to machine "B1" using TCP(514). It's possible to have many machines at level "C" all writing to machine "B1"'s port TCP(514), right? For the bonus point, can someone help me with the pertinent syntax for source, destination and log statements for my 4 machines? My job depends on me making this work... 8-) (If someone can replace my generic code below with exact code that will be parsed OK...) Machine A1 (10.5.11.9 - Solaris 5.8) source s_tcp { }; destination d_jnr { usertty("jnriopel"); }; log { source (s_tcp); destination (d_jnr); }; Machine B1 (10.5.10.4 - Linux) source s_tcp { frommachineC2}; source s_udp { frommachineC1}; destination d_tcp { tomachineA1 }; log { source (s_tcp, s_udp); destination (d_tcp); }; Machine C1 (10.5.2.8 - Linux) source src {unix stream }; destination d_udptoB1 { udp (machineB1 }; log { source (src); destination (d_udptoB1); }; Machine C2 (10.5.2.16 - Linux) source src {unix stream }; destination d_TCPtoB1 { tcp (machineB1 }; log { source (src); destination (d_TCPtoB1); }; Question 2: PMI, but I understand from my IP theory that I can send messages to another machine using UDP whether that machine is listening or not and not get errors, whereas is I want to talk using TCP, the machine I am talking to needs to have a listen set up first, ie I need to have syslog-ng running on A1 before I can start it on B1 otherwise B1 will complain about not being able to set up the connection, right? Will messages get lost or queued while waiting for A1 to start listening? Question 3: What is the syntax of the source and destination statements for two machines using syslog-ng and wanting to communicate over TCP port 666, say? (As in my link between A1 and B1 above except for the non-standard port number.) Jacques

2 1

program destination, not respawning programs ?
by Thomas Ackermann 11 Apr '02

11 Apr '02

hy! i'm using syslog-ng to send remote log messages over an stunnel to a log server. everything's running quite fine, besides one little problem i have.. i'm starting the stunnel with program("/usr/sbin/stunnel -r 192.168.3.125:6543 -c"); when the stunnel is killed or quits because of a bad connection, syslog-ng doesn't even bother 'bout trying to restart it. is that a wanted behaviour and, or, is there a way to gat syslog-ng to respawn processes called with program() ? thx, thomas

1 0

Re: [syslog-ng]hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 11 Apr '02

11 Apr '02

Hmm OK, how should I set the permissions of the file? Thanks, Bret Balazs Scheidler <bazsi(a)balabit.hu> 11/04/2002 03:26 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: (bcc: WATSON Bret/IT/CHRT/ST Group) Subject: Re: [syslog-ng]hosts... today's stupid question :} On Thu, Apr 11, 2002 at 08:18:51AM +0800, bretwatson(a)charteredsemi.com wrote: > Hi Bazsi, > but it is listed as a valid macro and digging through the code it is > actually there as in the macroexpansion proc... > > does that mean not all macro identifiers are currently being expanded? > Which ones are valid? > > destination host { file("/usr/log1/$HOST/$YEAR$MONTH$DAY" owner(root) group(logusers) perm(0640) dir_perm(0755)); }; ^^^^ macros are not reserved words, I meant the name of your destination. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Re: [syslog-ng]hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 11 Apr '02

11 Apr '02

Hi Bazsi, but it is listed as a valid macro and digging through the code it is actually there as in the macroexpansion proc... does that mean not all macro identifiers are currently being expanded? Which ones are valid? Cheers Bret Balazs Scheidler <bazsi(a)balabit.hu> 10/04/2002 05:26 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: (bcc: WATSON Bret/IT/CHRT/ST Group) Subject: Re: [syslog-ng]hosts... today's stupid question :} On Wed, Apr 10, 2002 at 08:22:26AM +0800, bretwatson(a)charteredsemi.com wrote: > > Hi All, > a stupid question most probably, > I'd like to build a generic destination for my default filter so that any > new hosts get dropped into their own directory > > something like > destination host { file("/usr/log1/$HOST/$YEAR$MONTH$DAY" owner(root) > group(logusers) perm(0640) dir_perm(0755)); }; > > But syslog-ng doesn't seem to like it and complains of syntax errors all > the time.. host is a reserved word, don't use it for identifiers. the best bet is to prefix identifiers with the purpose, e.g. d_host for destination f_host for filters and so on. It will not collide with reserved words then. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

2 1

Re: [syslog-ng]hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 11 Apr '02

11 Apr '02

hmm must have been a typo somewhere in the command - I started afresh and now it works :} Cheers, Bret [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

1 0

[PATCH] Unixtime (again)
by Gert Menke 10 Apr '02

10 Apr '02

Hi! Here's my Unixtime-Patch again, this time against syslog-ng-1.5.15. Balazs, I understand that you don't have much time, but please tell me what you think of it and if you will include it in 1.5.16, or why you won't. Also, I would like to have an option do define one or more default templates, perhaps like this: template t_unixtime { "$S_UNIXTIME $R_UNIXTIME $SOURCEIP $HOST $MSG\n" }; template t_isotime { "$S_ISOTIME $R_ISOTIME $SOURCEIP $HOST $MSG\n" }; destination d_foo { file("foo.log"); template(t_unixtime); }; destination d_bar { file("bar.log"); template(t_unixtime); }; destination d_human-readable { file("human-readable.log"); template(t_isotime); }; How can I do this? Could you help me implementing it? Greetings Gert

1 0

hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 10 Apr '02

10 Apr '02

Hi All, a stupid question most probably, I'd like to build a generic destination for my default filter so that any new hosts get dropped into their own directory something like destination host { file("/usr/log1/$HOST/$YEAR$MONTH$DAY" owner(root) group(logusers) perm(0640) dir_perm(0755)); }; But syslog-ng doesn't seem to like it and complains of syntax errors all the time.. Any hints? Thanks, Bret [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

2 1

RE: Passing IP address to a program
by Kevin Welch 09 Apr '02

09 Apr '02

Ignore that, its early. -----Original Message----- From: Kevin Welch Sent: Tuesday, April 09, 2002 8:04 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: Passing IP address to a program When my log events come in, I want to pass some of them to an external program to e-mail them, since the log event does not contain the ip address of the host, is there a way to pass this information along with the syslog event? -- Kevin

1 0

Passing IP address to a program
by Kevin Welch 09 Apr '02

09 Apr '02

When my log events come in, I want to pass some of them to an external program to e-mail them, since the log event does not contain the ip address of the host, is there a way to pass this information along with the syslog event? -- Kevin

1 0

Secondary date code
by Kevin Welch 08 Apr '02

08 Apr '02

All my syslog events have two date codes, is there any way to stop this? Apr 8 15:11:29 208.224.0.252 32200: Apr 8 14:11:28.307 EST: %SYS-5-CONFIG_I: Configured from console by vty1 (206.114.47.144) -- Kevin

1 0

RE: [syslog-ng]syslog-ng
by Michael Earls 08 Apr '02

08 Apr '02

i never ran into that problem on debian, i did have have it working to log to mysql,. but i was using mysql / pipe to enter stuff in the table, but the mysql client would die, for some unknow reason, that is why i am looking at a differnet way to set it up, and i need advise/help thanks michael www.vermeer.org -----Original Message----- From: AGehring(a)bis.adp.com Sent: Monday, April 08, 2002 2:28 PM To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> Subject: RE: [syslog-ng]syslog-ng I don't see how adding the ability for syslog ng to write to a database (SQL based) is any more different/difficult the allowing it to write to a file... We've modified it to natively write to Sybase... The problem with external programs, at least in our case, was that we would end up having 20+ process running to get the data where we needed it.... Andrew

1 0

RE: [syslog-ng]syslog-ng
by Gehring, Andrew x66132 08 Apr '02

08 Apr '02

I don't see how adding the ability for syslog-ng to write to a database (SQL based) is any more different/difficult the allowing it to write to a file... We've modified it to natively write to Sybase... The problem with external programs, at least in our case, was that we would end up having 20+ process running to get the data where we needed it.... Andrew

1 0

RE: [syslog-ng]syslog-ng
by Michael Earls 08 Apr '02

08 Apr '02

The reason I want it to log to a database is that I have over 100 routers and switches in different cities, I want a central Syslog server, I want all of techs in each city to be able to view the Syslog messages from a web browser anywhere. The only way I know to do this is have Syslog log to some database then have php/perl search from the web. What is the best way for me to do this with Syslog-ng? thanks michael -----Original Message----- From: bazsi(a)balabit.hu Sent: Wednesday, April 03, 2002 4:55 AM To: <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng]syslog-ng On Wed, Apr 03, 2002 at 03:38:03AM 0500, Michael Earls wrote: > Will syslog ng ever be native to log to mysql or any other type of > external database? I don't understand what the problems with using an external program for such purpose are. Simply write a 10 line long perl script where you can even preprocess messages before they go to the database, and feed this script with a pipe/program destination. Adding support for pgsql/mysql/sybase/whatever into syslog ng is bloat in my opinion. Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog ng maillist syslog ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog ng

1 0

RE: [syslog-ng]syslog-ng
by Michael Earls 08 Apr '02

08 Apr '02

the ver of syslog-ng 1.5.15, does it support templates? i can not get this line to work in this ver,, ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; is there a debug mode and where does that debug file go? thanks michael

1 0

io.c: do_write: write() failed (errno 146), Connection refused
by Vaningh, Ronny 08 Apr '02

08 Apr '02

My syslog-ng sometimes dies with the following message Apr 8 11:20:02 local@loghost syslog-ng[18617]: io.c: do_write: write() failed (errno 146), Connection refused I`m writing to a file on a local disk and forwarding over udp to a plain unix syslog server destination pix { file("/prod/log/$HOST/pix.log" create_dirs(yes) ); }; destination blah { udp(1.2.3.4); }; # # Lets chain everything together # log { source(net); filter(f_pix); destination(pix); destination(blah); }; Any idea what is causing this Thanks Ronny

1 0

RE: Filter Question.
by Kevin Welch 04 Apr '02

04 Apr '02

I fixed it.... after I found the link to the archives, I managed to figure out that the ; makes a big difference. -- Kevin -----Original Message----- From: Kevin Welch Sent: Thursday, April 04, 2002 2:57 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: Filter Question. Im trying to setup a filter as follows: filter f_terse { facility(local7); and match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; filter f_notterse { facility(local7); and not match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; Now my problem is that this doesnt work and kicks back an error, it seems I cannot use the match keyword and define other parameters. Is this correct or do I have the syntax messed up? My reason for needing this is that terse call records from my my dial systems take over 10000 calls a day and generate alot of syslog information, I need a way to filter these to a different logfile from other syslog events. Thanks -- Kevin

1 0

Filter Question.
by Kevin Welch 04 Apr '02

04 Apr '02

Im trying to setup a filter as follows: filter f_terse { facility(local7); and match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; filter f_notterse { facility(local7); and not match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; Now my problem is that this doesnt work and kicks back an error, it seems I cannot use the match keyword and define other parameters. Is this correct or do I have the syntax messed up? My reason for needing this is that terse call records from my my dial systems take over 10000 calls a day and generate alot of syslog information, I need a way to filter these to a different logfile from other syslog events. Thanks -- Kevin

1 0

Newbie questions.
by Stephen Amadei 04 Apr '02

04 Apr '02

Hello. I have been considering changing to syslog-ng for a while now, but I've been unable to wrap my brain around the idea since I don't exactly understand how syslog-ng replaces the old syslog. My first question is just that: How does syslog-ng replace the syslog? Do you simply remove klogd and syslogd from running and run syslog-ng instead? Is there a sample syslog-ng.conf that I can use to approximate the old syslog functionality until I get brave enough to tinker with it myself? My next concern is the "syslog -a" function. Where chrooting programs, I need to create extra /dev/log things by using the -a option. Can Syslog-ng also do this? Does syslog-ng still use the normal /dev/log device? I'm sorry if these are simple questions, but I think I will be pretty well set if I understand how closely to syslog syslog-ng works. ----Steve Stephen Amadei Dandy.NET! CTO Atlantic City, NJ

1 0

syslog-ng
by Michael Earls 03 Apr '02

03 Apr '02

Will syslog-ng ever be native to log to mysql or any other type of external database? thanks michael

3 2

Re: [syslog-ng]syslog-ng
by bretwatson＠charteredsemi.com 03 Apr '02

03 Apr '02

If you really want there is some work on a system that takes syslog on stdin and feeds into a modified snort IDS - thus you can have stateful inspection of content and all sorts of filtering.. look at sourceforge for snortadapter Bret Balazs Scheidler <bazsi(a)balabit.hu> 03/04/2002 05:55 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: (bcc: WATSON Bret/IT/CHRT/ST Group) Subject: Re: [syslog-ng]syslog-ng On Wed, Apr 03, 2002 at 03:38:03AM -0500, Michael Earls wrote: > Will syslog-ng ever be native to log to mysql or any other type of > external database? I don't understand what the problems with using an external program for such purpose are. Simply write a 10 line long perl script where you can even preprocess messages before they go to the database, and feed this script with a pipe/program destination. Adding support for pgsql/mysql/sybase/whatever into syslog-ng is bloat in my opinion. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

1 0

Filtering out multiple entries in log files due to different level
by Nick Chondropoulos 03 Apr '02

03 Apr '02

I just started testing syslog-ng in our enviroment a few days ago. I've been able to do what I want for the most part but the one thing that I'm stuck on (and it's probably a stupid admin trick I've missed) is to remove multiple entries from a log file due to level reporting. The necessary bit of backgound: Solaris 8 10/01 on both the client and server. The config file is: --------------------------------------------------------------------- options { sync(0); time_reopen(10); log_fifo_size(100); keep_hostname (no); chain_hostnames (no); create_dirs (yes); }; source net { udp (); }; destination all_by_host-facility { file ("/var/logs/$HOST/$FACILITY/$YEAR/$HOST.$FACILITY.$YEAR.$MONTH.log"); }; destination all_by_facility { file ("/var/logs/$FACILITY/$YEAR/$MONTH/$FACILITY.$LEVEL.$YEAR.$MONTH.log"); }; log { source(net); destination(all_by_host-facility); destination(all_by_facility); }; --------------------------------------------------------------------- I get the logs to split out by hostname year etc. but I get multiple entries in a log file the higher the level. The idea was to log a facility per file so I expected a single entry in the log file which I guess was a woring assumption. Is there a way to stop the following from happening: client> logger -p auth.emerg EMERG server> tail <log> Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG and replace it with a single line of: Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Is it even a syslog-ng config question? Maybe it's an OS question. TIA Nick -------------------------------+------------------+------------------- Nick Chondropoulos | Schlumberger | ZHTW H ELLAS Senior UNIX Systems Manager | 525 3rd Ave S.W. | nickc(a)calgary.geoquest.slb.com | Calgary, AB | If it's not P) 403-509-4000 | CANADA | dedicated hardware F) 403-509-4170 | T2P 0G4 | it's crap! -------------------------------+------------------+------------------- QUOMODO ARDUUM ESSE POSSIT

2 1

Is there a way to define message priority for syslog-ng?
by Antai Ning 03 Apr '02

03 Apr '02

4 5

(no subject)
by joyce_qian 02 Apr '02

02 Apr '02

syslog-ng，您好！致礼！ joyce_qian joyce_qian(a)mail.ihep.ac.cn

1 0

warning
by John_Delisle＠ceridian.ca 02 Apr '02

02 Apr '02

One thing to watch for in the latest version of syslog-ng - If you create a destination of /dev/null it changes the permissions on /dev/null to 0600 by default. This causes all sorts of problems. Perhaps a warning is in order? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 ********************************************************************** This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege. If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please notify the sender immediately. **********************************************************************

2 1

[PATCH] Unixtime Macros
by Gert Menke 29 Mar '02

29 Mar '02

Hi! The following patch adds the Macros $UNIXTIME, $S_UNIXTIME and $R_UNIXTIME. They give you the time in the internal unix time format (seconds since 1970 or so). Since it is useful for me, it is probably useful for others, too. This patch is against syslog-ng-1.5.14 with my sourceip127-patch (which I posted on 05.Feb.2002), but will also work with the plain syslog-ng-1.5.14 sources (with an offset of -3 lines). Balazs, please include this patch in the next release if you find it useful. Greetings Gert

1 0

templates...
by Dave Patterson 29 Mar '02

29 Mar '02

Hello, has anyone had any luck /w templates <to configure the way syslog-ng writes its log> I'd like to call a template file containing the information if possible. this is my current config: template {date '+%b %e %T' hostname PROGRAM:} destination d_program {file("/var/syslog-ng/$HOST/$PROGRAM/$MONTH_$DAY" perm(0644) compress (yes) template(template)) }; I'm not haveing any luck at all,... any help is apprecated, Thanks Dave Patterson

2 1

RE: [syslog-ng]syslog-ng pix help
by John Coke 28 Mar '02

28 Mar '02

Are you still having problems? I have my pixen logging, I might be able to help. -----Original Message----- From: Steve [mailto:steve_slog_ml@timko.com] Sent: Thursday, March 28, 2002 1:49 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng pix help ok now I got pix.log file collecting info but It seems the pix is sending syslog out to err so messages and console is still logging everything which is ugly.. what am I donig wrong? I tried filter f_not_pix { host(regexp to match host); }; that didn't work.. -steve On Thu, 28 Mar 2002, Steve wrote: > ok I got logging in debug mode working on the pix but now everything is > coming to console and messages.. > > I'm trying to get it just to log to pix.log filename.. > > nothing there.. > > -s > > > On Thu, 28 Mar 2002, Steve wrote: > > > Hello, > > > > I saw this post: > > > > http://lists.balabit.hu/pipermail/syslog-ng/2001-November/002760.html > > > > and I'm kinda having a simular problem, but I can't even get logging to > > work. At one point I had the pix logs going to console... > > > > > > Now I got nothing.. > > > > Heres what I got in syslog-ng.conf > > > > destination pix { file("/var/log/pix.log"); }; > > # > > # host filters > > # > > filter f_pix { host(10.1.5.3); }; > > log { source(src); filter(f_pix); destination(pix); }; > > > > > > Does it matter where you put this lines? > > > > thanks for the help if u can.. > > > > > > oh yea > > > > pix has this enabled: > > > > pixfirewall# show loggi > > Syslog logging: enabled > > Timestamp logging: disabled > > Standby logging: disabled > > Console logging: disabled > > Monitor logging: disabled > > Buffer logging: disabled > > Trap logging: disabled > > History logging: disabled > > > > along with > > > > ogging on > > no logging timestamp > > no logging standby > > no logging console > > no logging monitor > > no logging buffered > > no logging trap > > no logging history > > logging facility 20 > > logging queue 512 > > logging host inside 10.1.5.222 > > > > > > > > thanks for any help > > > > -steve > > > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

syslog-ng pix help
by Steve 28 Mar '02

28 Mar '02

Hello, I saw this post: http://lists.balabit.hu/pipermail/syslog-ng/2001-November/002760.html and I'm kinda having a simular problem, but I can't even get logging to work. At one point I had the pix logs going to console... Now I got nothing.. Heres what I got in syslog-ng.conf destination pix { file("/var/log/pix.log"); }; # # host filters # filter f_pix { host(10.1.5.3); }; log { source(src); filter(f_pix); destination(pix); }; Does it matter where you put this lines? thanks for the help if u can.. oh yea pix has this enabled: pixfirewall# show loggi Syslog logging: enabled Timestamp logging: disabled Standby logging: disabled Console logging: disabled Monitor logging: disabled Buffer logging: disabled Trap logging: disabled History logging: disabled along with ogging on no logging timestamp no logging standby no logging console no logging monitor no logging buffered no logging trap no logging history logging facility 20 logging queue 512 logging host inside 10.1.5.222 thanks for any help -steve

1 2

Feature request: Default template
by Gert Menke 28 Mar '02

28 Mar '02

Hello, Balazs! I need a configuration option for a default template which is used whenever I don't specify one explicitly. If you don't have the time for implementing it in the near future I would very much appreciate any hints on how to do it myself. Thank you! Greetings, Gert

1 0

Re: [syslog-ng]DNS caching
by Ted_Rule＠flextech.co.uk 21 Mar '02

21 Mar '02

A couple of things... > You also mention "syslog-ng blocks on DNS queries, so enabling DNS may lead > to a Denial of Service attack." in your documentation. Does this mean that > syslog messages which are received by the NIC, while syslog-ng performs a > synchronous DNS lookup, are stored in the kernels receive buffer or are > dropped? My belief is that your presumption is indeed correct, and that the kernel will store such inbound UDP messages in the local socket buffer ( usually of the order of 10's of kbytes big ) whilst performing gethostbyaddr() or equivalent. Reworking any such daemon to be multi-threaded enough to use the re-entrant version gethostbyaddr_r() instead, and thereby allow only the given source socket whence the original syslog message arrived to be blocked pending the DNS response, is something I would imagine syslog-ng has not yet been encoded to perform. However, I have come across a even worse problem with syslog ( non-NG syslogd that is ) and DNS, namely a terrifying full blown hard deadlock. This for Linux kernel 2.2.19 + latest RedHat syslogd ( with Unix DGRAM sockets preferred ) + local bind 8.2.3 server, whilst acting as remote syslog receiver. The problem only appeared to arise under extreme conditions, once in a blue moon. After months of tortuous attempts at debugging the problem, the issue appears to be that syslogd ( as I said this is not syslog-ng but it might yet apply which is why I raise the issue here ) deadlocks when it attempts to perform gethostbyaddr() ( and hence res_query() ) to localhost:53, whilst at exactly the same instant, the DNS server sitting on localhost:53 perform a syslog operation in respect of something/anything/perhaps completely unrelated, ( such as logging a Zone Transfer complete ). At this point syslogd/gethostbyddr() are blocked waiting on the DNS server, and the DNS server is blocked waiting on syslogd(). Note that this flies in the face of what one might deduce might happen, namely that gethostbyaddr() times out waiting for localhost:53 to reply ( because the DNS server is temporarily deadlocked waiting for syslogd itself ), and works round the deadlock by performing the DNS query against the secondary DNS server in /etc/resolv.conf. Once this deadlock has occurred, any given process which potentially uses syslog deadlocks on the next occasion it attempts to use syslog(). Over a matter of minutes or less, the whole system deadlocks on syslogd, BUT snmpd ( which very rarely syslogs ) and ping ( which is unlikely to syslog unless something in ipchains or similar performs a printk() ) continue to function Ok. Thus simplistic monitoring of the host indicates nothing untoward via SNMP / ping but end-user experience is deadly. The best solution I have so far is to ensure syslogd never uses a local DNS server, but instead always uses a remote DNS server to perform the lookups. Under these conditions, any such deadlock appears to be recoverable, as gethostbyaddr() never blocks waiting on the local DNS server. Whilst using nscd improves the situation - make it less likely to occur - and including a small DNS cache within the syslogd process itself, make it less likely still, neither workround completely fixes the potential deadlock. And of course even trying to debug for such a deadlock is fraught with difficulties. I feel the really proper solution where one strongly desires to run a local DNS server, as intimated above, is to multi-thread the syslog daemon, use a fully threaded resolver library, and only block the socket the message arrived on whilst performing the gethostbyaddr_() - and I haven't had enough strong coffee all year to face attempting that nightmare rewrite! As to why the deadlock really occurs - i.e. why gethostbyaddr() doesn't simply timeout, fall through to backup DNS server, and thereby release the deadlock - I have no idea. Maybe it somehow got fixed in Kernel 2.4? Again, testing the theory is tricky. If anyone has further ideas on releasing the deadlock, I'd be only too happy to hear from you. By the by, I've been looking into migrating to syslog-ng for other reasons anyway, mainly due to its more fine-grained filtering structure, and despite some minor reservations I'm happily impressed with what I've seen. Many thanks to all involved in its development so far. Ted Rule, Flextech Television. *************************************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ***************************************************************************************************

1 0