- syslog-ng - lists.balabit.hu

RE: [syslog-ng]Possible overflow?
by Nicholas Berry 08 Feb '02

08 Feb '02

I didn't see if any mailed in a resolution to this problem, I'm still having it. I'm running Solaris 8 (SPARC) w/syslog-ng-1.5.13 and libol-0.3.1. Also, when I run more or less on one of the log files, I occassionally get the error "file may be a binary, continue?" >I too get high ASCII characters, but on a regular basis across multiple systems. > I have about 20 hosts logging to two syslog-ng systems. I see this anywhere from > a Foundry routers, to Solaris 8, and Lucent Maxes: > ..smf-jumpstart A<A0><E1>$<30>Dec 1.. > ..smf-modem-01 ^B^D^E<B4><134>ASCEND: slot 2.. > ..smf-dist-01 ^B^D^E<B4><14>smf-dist-01, Interface... Thanks, Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com -----Original Message----- From: Nicholas Berry Sent: Friday, December 21, 2001 9:20 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Possible overflow? I too get high ASCII characters, but on a regular basis across multiple systems. I have about 20 hosts logging to two syslog-ng systems. I see this anywhere from a Foundry routers, to Solaris 8, and Lucent Maxes: ..smf-jumpstart A<A0><E1>$<30>Dec 1.. ..smf-modem-01 ^B^D^E<B4><134>ASCEND: slot 2.. ..smf-dist-01 ^B^D^E<B4><14>smf-dist-01, Interface... Thanks, Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com -----Original Message----- From: Thomas Kaehn [mailto:tk@westend.com] Sent: Friday, December 21, 2001 3:04 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Possible overflow? Hi, in some logs I discovered an ascii character with the value 181 instead of a newline: ... D4-RIPE|<181>Dec 20 19:02 ... Unfortunately I can't reproduce this error. But maybe it's a known error? It occured when logging whole mails to syslog. Does anyone know a possible cause? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Re: [syslog-ng]syslog-ng doesn't properly close file sources?
by Balazs Scheidler 07 Feb '02

07 Feb '02

On Tue, Feb 05, 2002 at 07:58:18PM -0500, Ed Ravin wrote: > Sorry to be a pest, but did you ever get a chance to look at this? > It's still happening in 1.5.14 on NetBSD 1.5.2. A new backtrace > is below. > > I am willing to try and fix it myself, but it would really help if > you could point me in the right direction. I see in main.c that a > HUP triggers io_callout(...) which goes to libol - is the problem > there or is it just a matter of setting up the right callback stuff > for flush or close in affile.c? I've checked it out by then, and it did close the file source, but after reinitializing the configuration. It works on Linux, but doesn't on NetBSD as it seems. I patched my tree on my notebook to close the fd earlier, but I forgot to include it in 1.5.14. Here's the patch: diff -u -r1.45 affile.c --- affile.c 2002/02/05 15:49:05 1.45 +++ affile.c 2002/02/06 15:03:44 @@ -106,6 +106,7 @@ (name affile_source) (super log_source_driver) (vars + (res pointer "struct resource_node") (flags . UINT32) (src object io_fd) (name string))) @@ -122,13 +123,11 @@ else flags = O_RDONLY | O_NOCTTY | O_NONBLOCK; if (do_open_file(self->name, flags, -1, -1, -1, -1, -1, -1, 0, &fd)) { - struct resource_node *res; - lseek(fd, 0, SEEK_END); self->src = io_read(make_io_fd(cfg->backend, fd, ol_string_use(self->name)), make_log_reader(0, c), NULL); - res = REMEMBER_RESOURCE(cfg->resources, &self->src->super.super); + self->res = REMEMBER_RESOURCE(cfg->resources, &self->src->super.super); return ST_OK | ST_GOON; } else { @@ -144,12 +143,20 @@ HANDLE_LOG(self->super.super.next, log); } +static void do_destroy_affile_source(struct log_handler *c, struct syslog_config *cfg, struct persistent_config *persist) +{ + CAST(affile_source, self, c); + if (self->res) + KILL_RESOURCE_NODE(cfg->resources, self->res); +} + struct log_source_driver *make_affile_source(const char *name, int flags) { NEW(affile_source, self); self->super.super.super.init = do_init_affile_source; self->super.super.super.handler = do_affile_handle_line; + self->super.super.super.destroy = do_destroy_affile_source; self->name = c_format_cstring("%z", name); self->flags = flags; return &self->super; you'll need scsh to rebuild the sources. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 3

syslog-ng mysteriously exits
by John Coke 07 Feb '02

07 Feb '02

Syslog-ng-1.4.14 on a redhat 7.2 server is mysteriously crashing/exiting and I am having trouble tracing the problem. There is no core and when I run the service in debug, it does not exit. It normally exits within 2 or three hours. What can I do next to try and find the problem? Regards, -John

2 1

File mask.
by Scott A. McIntyre 06 Feb '02

06 Feb '02

Hi, Somewhere in the process of upgrading from 1.5.3 to 1.15.14 the process by which the umask is used somehow changed. Whenever I HUP syslog-ng now, the files opened for writing are set to 600, when I want/need 644. I see that there's a permissions option for unix streams, but what about files? I don't see anything obvious in the source, but maybe I'm just looking in the wrong place. Thanks for any pointers! Scott

2 1

syslog-ng 1.5.14 released
by Balazs Scheidler 06 Feb '02

06 Feb '02

Hi, syslog-ng 1.5.14 was released with the following NEWS entry: News for the 1.5.14 release Tue, 5 Feb 2002 11:35:52 +0100 New features: * tcp wrapper support * added several new macros in filename expansion * support for simple log rotation (remove_if_older) It can be downloaded from http://www.balabit.hu/en/downloads/syslog-ng -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 5

log rotation feature - patch
by klaas.vangend＠philips.com 05 Feb '02

05 Feb '02

Gentlemen, As stated last friday, I'd like enhance syslog-ng with some features in order to get rid of some log rotation scripts: "For some of our systems, we log to a centralised system, but also store the logs locally. These local logs only need limited availability, say a week or so. The file() destination currently is already able to use the target $WEEKDAYS, but in that case, logs from both Jan 17 and Jan 24 are logged in messages.Thu.log Therefore, I'd like to add a new option remove_if_older(X) which removes a logfile with a timestamp older than X days prior to writing the new message to that file. (default should be 0 (=never), which means that for a disabled feauture only one C 'if' statement additional overhead is caused)" I've finished implementing the above feature, which is attached as a patch. I patched against 1.4.14, the latest stable version, and it probably will work for the unstable tree, too. The patch compiles and is verified to work for SuSE Linux 6.4 (Linux 2.2.19 kernel, gcc 2.95.2, libc 2.1.3 ). I hope everybody thinks it's a nice feature and that this patch is soon added to a new stable syslog-ng release... (Please, Balazs???) Groetjes, Klaas van Gend

2 1

first day of month bug?
by Alex Howansky 04 Feb '02

04 Feb '02

(libol-0.2.23, syslog-ng 1.4.14) In my configuration, I have a destination defined like this: destination d_app { file("/var/log/app/$YEAR$MONTH$DAY"); }; This is a wonderful feature, as it gives me a sort of "automatic rotation" of logfiles. However, there seems to be a bug that occurs on the first of every month. If I look in the /var/log/app directory, I'll see files like: 20010201 20020101 20020102 20020103 [...] 20020129 20020130 20020131 20020201 20020202 Note that first file, stamped with 2001 instead of 2002. It actually contains entries that should have gone into 20020201. The entries in 20010201 all occur within the first hour of the day. It's as if the value of $YEAR is off by one during the first hour of the first day of a month. I tried searching the archives, no luck. Is this a know issue? Should I go to the 1.5 branch? -- Alex Howansky Wankwood Associates http://www.wankwood.com/

2 1

syslog-ng crash
by William D. Colburn (aka Schlake) 04 Feb '02

04 Feb '02

I induced my syslog-ng 1.4.14 to crash repeatably. I remember seeing some time ago that the author was in the hospital, and I see from the web page that not much has changed in quite a while, leading to beleive that he might still be indisposed. Normally I would disclose the crash to the list, but if no fix will be forthcoming I am afraid too let other people know how to down a server. Does anyone know if the author is still available, or if I should dig into the code to generate a patch on my own before releasing this information? -- William Colburn, "Sysprog" <wcolburn(a)nmt.edu> Computer Center, New Mexico Institute of Mining and Technology http://www.nmt.edu/tcc/ http://www.nmt.edu/~wcolburn

4 4

[PATCH] netmask-filter
by Gert Menke 04 Feb '02

04 Feb '02

Hi everybody, I have implemented a new filter for syslog-ng. You can now filter log messages based on their sender's IP address like this: # match a single host filter f_noc21 { netmask("134.130.3.73"); }; # match a whole subnet filter f_noc { netmask("134.130.3.0/255.255.255.0"); }; I'll attach patches for syslog-ng versions 1.4.14 and 1.5.13. I have also made a small patch that fixes the behaviour of the emulated inet_aton function in utils.c. (It would not work with "255.255.255.255".) On some architectures you need this patch for my netmask-filter to work properly! Have fun and tell me what you think about it! Greetings Gert

5 12

host() expression
by Chuck Kelly 04 Feb '02

04 Feb '02

I would like to be able to create a single filter for multiple hosts. Can someone help me with the syntax. i.e. filter f_sec1 { program(sudo) and host(host1 or host2 or host3) ; }; -- Chuck

2 1

Regular Expressions with Syslog-nt
by Leon Oosterwijk 04 Feb '02

04 Feb '02

All, I'm trying to use Regular Expressions for my hostname. I'm running into somewhat of a problem with finding out what I can match on. Here are my questions. I appears that the logging only matches on the host portion of the hostname unless you turn on use_fqdn(yes); in the options section. However, if I turn this on, it will start writing the entries to the log file as: > Jan 30 13:19:15 gw03-bna.isdn.net/gw03-bna.isdn.net I wish it to only write > Jan 30 13:19:15 gw03-bna/gw03-bna But still be able to match on FQDN. (BTW, what is the deal with the hostname/hostname. Can I make it just be "hostname" no slashes, and name duplication) The second issue is the RegEx Syntax. I'm trying this: filter f_rtr_bna { host("^.*rtr.nrep.bna.isdn.net$"); }; filter f_rtr_mem { host("^.*mem.isdn.net$"); }; Which is obviously not working. What do need to do here?

2 1

buffering during network outage between relays
by Martin, Sylvain R. (LNG) 04 Feb '02

04 Feb '02

We're logging the data to a central database from 2 relays. Is there a way for syslog-ng to buffer the data while the database server is rebooting or innaccessible? Here's our current setup. All machines forward the syslog msg to either a production or development relay which runs syslog-ng and then the messages are forwarded to a server running an oracle DB. You may wonder why we have 2 relays... well we have a few hundrer servers and workstations and we're just implementing the DB aspect of it. 15 Millions rows for 6months growing by 100K rows/day. on the DB server I have a custom written syslogd which buffers data in case the DB is down but the problem resides with syslog-ng interrupting the relay, for 60 seconds, of messages to the oracle DB server if the server dies or reboots. Is there someway for syslog-ng to relay missed messages? The only other way I can think of doing it is kinda messy... having syslog-ng dump to a FIFO pipe where a perl script could buffer the data in an array or file until the DB server comes alive again. We're using 1.4.14 -------------------- - Cloud of servers - -------------------- / \ / \ -------- ------- relays - prod - - dev - -------- ------- \ / \ / ------------- - oracle DB - ------------- Sylvain Martin

2 1

[PATCH] Bug in syslog-ng-1.5.13/src/affile.c/expand_macro
by Gert Menke 04 Feb '02

04 Feb '02

Hi! I think I have found a small bug/typo in affile.c. Here's the patch: diff -r -U3 syslog-ng-1.5.13-orig/src/affile.c syslog-ng-1.5.13-patched/src/affile.c --- syslog-ng-1.5.13-orig/src/affile.c Wed Oct 24 12:46:06 2001 +++ syslog-ng-1.5.13-patched/src/affile.c Tue Jan 29 14:21:25 2002 @@ -578,11 +578,11 @@ break; } break; + } case M_MESSAGE: { /* message */ length = append_string(dest, left, msg->msg->data, msg->msg->length, escape); break; - } } default: break; Greetings Gert

2 1

Re: first day of month bug?
by klaas.vangend＠philips.com 04 Feb '02

04 Feb '02

Alex Howansky <alex(a)wankwood.com> wrote: > Note that first file, stamped with 2001 instead of 2002. It actually contains > entries that should have gone into 20020201. The entries in 20010201 all occur > within the first hour of the day. It's as if the value of $YEAR is off by one > during the first hour of the first day of a month. If I look at the responsible code in affile.c: if (cfg->use_time_recvd) tm = localtime(&msg->recvd); else tm = localtime(&msg->stamp); switch (id) { case 'y': length = snprintf(*dest, *left, "%04d", tm->tm_year + 1900); break; I don't see any reason for this problem, so I expect your localtime() is buggy... (If you're familiar with C, you should be able to tell really quickly if you write some test code) Groetjes, Klaas van Gend

1 0

RE: [syslog-ng]sending message by email
by Ohrberg, Mick 01 Feb '02

01 Feb '02

Another method is to create a script called for instance syslog-ng-mail.sh, containing #!/bin/sh while read line; do echo $line | /usr/bin/mailx -s "$1" $2 done ...and then pipe all your matched messages to this script with two arguments of the subject and email address to send to. This makes it very generic. /Mick > -----Original Message----- > From: Stephen C Burns [mailto:sburns@farpointer.net] > Sent: Friday, February 01, 2002 10:31 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]sending message by email > > > > Assuming you have a comprehensive file with all of the messages in > /var/log/$HOST/messages, just set up a nightly cron job to cat > /var/log/$HOST/messages|mail your email > > At 09:47 AM 2/1/2002, you wrote: > >I have been trying, unsuccessfully, to setup email > notification of certain > >log messages. The filters I am using are working great, but my email > >notifications are empty. > >What I would like is to receive an email with a subject line > similar to > >"Log notification for hostname" where hostname is the system > the message > >was received from, with the body of the email containing the > log message. > >Is anyone else doing this? Can you provide an example of > your method, if so? > >Or, can anyone give me any pointers on making this work? > > > >--- > >David Monk CCNA, MCSE > ><mailto:david@purplebear.net>david(a)purplebear.net > > > >The more things change, the more they stay insane. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

4 5

sending message by email
by David Monk 01 Feb '02

01 Feb '02

I have been trying, unsuccessfully, to setup email notification of certain log messages. The filters I am using are working great, but my email notifications are empty. What I would like is to receive an email with a subject line similar to "Log notification for hostname" where hostname is the system the message was received from, with the body of the email containing the log message. Is anyone else doing this? Can you provide an example of your method, if so? Or, can anyone give me any pointers on making this work? --- David Monk CCNA, MCSE david(a)purplebear.net The more things change, the more they stay insane.

2 2

questions
by luoli1974 30 Jan '02

30 Jan '02

hello! I meet some questions when I make syslog-ng .Sure that I configure it before doing this. Questions reports: sources.h:33: list.h: No such file or directory main.c:29: format.h: No such file or directory main.c:30: werror.h: No such file or directory ... etc. version:1.4.4 Give me help ,Thanks for you help! ============================================================= http://popme.163.com/sms/vip.html ¶©°üÔÂ¶ÌÐÅÏ¢¡¢ËÍÍøÒ×VIPÊÕ·ÑÓÊÏä http://friend.163.com ÓÐÊÖ»úŸÍÄÜVœ»ÓÑ£¬ŽŽÔìVÉú»î£¡ http://news.163.com/editor/etalk.html ÍøÑÔÒ×Óï£ºÆß×ì°ËÉàŽóŒÒËµ http://love.163.com ŽºÌì»š»á¿ª£¬ÄÐº¢Å®º¢ÒªÁµ°®¡«

2 1

possible bug in syslog-ng with logrotate?
by greg whorley 30 Jan '02

30 Jan '02

I edited my log rotate conf file on RH 7.2 so that it will rotate/gzip the custom log names I have given for the normal logs (i.e. messages is now big.log and maillog is mail.log). A couple days ago, the log rotator did it's job and rotated/gzipped the logs. However, no new logs appeared. I noticed this two days after the rotation. I restarted syslog-ng and they started filling up again. Does anyone know why this may have happened? -- _______________________________________________ Sign-up for your own FREE Personalized E-mail at Mail.com http://www.mail.com/?sr=signup Win a ski trip! http://www.nowcode.com/register.asp?affiliate=1net2phone3a

2 1

syslogd logging to syslog-ng. [2]
by Yan Lau 29 Jan '02

29 Jan '02

I knew I forgot to put this in my previous message. I've distilled my syslog-ng.conf file to: # syslog-ng configuration file. options { sync (0); time_reopen (10); log_fifo_size (1000); create_dirs (yes); chain_hostnames (yes); use_dns (no); use_fqdn (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); tcp(); udp(); }; destination d_file_messages { file("/var/adm/messages" perm(0644)); }; filter f_lvl_err { level(err); }; log { source(s_sys); filter(f_lvl_err); destination(d_file_messages); } When I start syslog-ng, I get this: # /usr/local/sbin/syslog-ng -v -f /tmp/my.conf binding fd 7, inetaddr: 0.0.0.0, port: 514 binding fd 8, inetaddr: 0.0.0.0, port: 514 Yan.

1 0

syslogd logging to syslog-ng.
by Yan Lau 29 Jan '02

29 Jan '02

I've set up a server with syslog-ng. It works find for local messages. On another server I'm running the syslogd that came with the system (Solaris). I've tried to set up the old syslogd server to forward messages to the syslog-ng server. However, I can not get it to work. For instance, I have under the old syslog.conf: user.notice @log.globix.net In debug mode it shows: writemsg(6): Logging msg 'Jan 29 14:26:27 ylau: hi there' to FORW log.globix.net However, when I truss syslog-ng with -dv options, it doesn't receive anything. I'd rather not have to install syslog-ng on all the servers. Yan. (I speak for myself only)

2 1

How do I make logging of a message to stop after certain filter?
by Subodh Nijsure 29 Jan '02

29 Jan '02

Hello, I have seen reference to this in some syslog-ng document but I can not find it now. What I want to do is log ftpd or dhcpd related messages to go to ftpd.log and dhcpd.log respectively. But I also have "default" rule that catches all messages not logged, currently what is happening is all the ftp and dhcpd messages are getting logged to ftpd.log and dhcpd.log , but they are also getting logged to here is the relevant section of the syslog-ng.conf file source scm_messages { unix-dgram("/dev/log"); internal(); }; filter f_ftpd { match("ftpd"); }; filter f_dhcpd { match("dhcpd"); }; destination ftpdlog { file("/var/log/ftpd.log"); }; destination dhcpdlog { file("/var/log/dhcpd.log"); }; destination scmlog { file("/var/log/scm.log"); }; log { source(scm_messages); filter(f_ftpd); destination(ftpdlog); }; log { source(scm_messages); filter(f_dhcpd); destination(dhcpdlog); }; <<- I want ftp logging to stop here log { source(scm_messages); destination(scmlog); }; <<---- This is my catchall entry Also does syslog-ng have any options to set max-size of the log file? or do I have to run logroate? Thanks. /Subodh Nijsure Software Manager - Network Media Routers SkyStream Networks

1 0

Re: [syslog-ng]Leaky syslog-ng files?
by Michael Earls 27 Jan '02

27 Jan '02

What does your config file look like, here is an ex, of mine, i use filters to to force the host to log to the text file. ## tking switch 192.168.3.254 destination 192.168.3.254 { file("/var/log/routers/tking-switch.log"); }; filter f_192.168.3.254 { host(192.168.3.254); }; log { source(net); filter(f_192.168.3.254); destination(192.168.3.254); }; michael http://vw.vermeer.org/syslog-ng/ >>> rob(a)rascal.ca 01/19/02 18:23 PM >>> Hi everyone, I'm pretty new to syslog-ng, but I really like it so far, except for one thing I can't figure out...(it could be a clueless newbie issue.) I'm using syslog-ng on FreeBSD 4.4 to log everything for about 10 cisco routers/switches right now, with about 30 more that will be added over the next week or two. I have them logging to separate files right now, and that works great, with newsyslog archiving stuff, etc etc. Works wonderfully. However, everything keeps leaking into my /var/log/messages file, which I don't want it to do. I *just* want it in their separate files. An example of what I use for filters is: filter f_gig2 { host("gig2-0"); }; And for log: log { source(src); filter(f_gig2); destination(gig2); }; And for destination: destination gig2 { file("/var/log/peer1/vancouver/gig2-0"); }; Anyone have any suggestions? Thanks in advance! -Rob. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2

RE: [syslog-ng]Where is the web page
by Ohrberg, Mick 24 Jan '02

24 Jan '02

http://www.balabit.hu/ works fine for me. > -----Original Message----- > From: Mihai Barbos [mailto:Mihai.Barbos@eurospider.com] > Sent: Thursday, January 24, 2002 11:57 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Where is the web page > > > Hi, > > I'm trying to connect to www.balabit.hu (hompage for > syslog-ng) but it > seems that it dissapeard. Can anyone tell me where is it gone ? > > Regards, > > Mihai > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

Where is the web page
by Mihai Barbos 24 Jan '02

24 Jan '02

Hi, I'm trying to connect to www.balabit.hu (hompage for syslog-ng) but it seems that it dissapeard. Can anyone tell me where is it gone ? Regards, Mihai

2 1

log rotation features for syslog-ng
by klaas.vangend＠philips.com 24 Jan '02

24 Jan '02

Gentlemen, I'd like enhance syslog-ng with some features in order to get rid of some log rotation scripts. For some of our systems, we log on a centralised system, but also store the logs locally. These logs only need limited availability, say a week or so. The file() destination currently is already able to use the target $WEEKDAYS (which is undocumented, btw), but in that case, logs from both Jan 17 and Jan 24 are logged in messages.Thu.log Therefore, I'd like to add a new option clear_old(X) which removes a logfile with a timestamp older than X days prior to writing the new message to that file. (default should be 0 (=never), which means that for a disabled feauture only one C 'if' statement additional overhead is caused) But I can imagine that people also wants to set a max size on a logfile. E.g. to be able to compress it afterwards, or for simple log rotation, like: file('/var/log/mesages' max_size_old(200, 'gzip')) will rename the existing 200 kB file to /var/log/messages.old and then run 'gzip /var/log/messages.old' Maybe it is better to add a new destination rotatedfile(), maybe it's better to do something else... I'd to know wheter everyone agrees that these features are a good idea, and that the proper approach is taken to keep the configurationfile syntax simple. Groetjes, Klaas van Gend

3 2

Syslog-ng on Boot
by jesse.keefe＠convergys.com 23 Jan '02

23 Jan '02

For those who asked about starting syslog-ng on boot, here is what I did for Solaris 8. I simply modified the /etc/rc2.d/S74syslog script: case "$1" in 'start') if [ -f /etc/syslog-ng/syslog-ng.conf -a -f /usr/sbin/syslog-ng ]; then echo 'syslog-ng service starting.' # # Before syslogd starts, save any messages from previous # crash dumps so that messages appear in chronological order. # /usr/bin/savecore -m if [ -r /etc/dumpadm.conf ]; then . /etc/dumpadm.conf [ "x$DUMPADM_DEVICE" != xswap ] && \ /usr/bin/savecore -m -f $DUMPADM_DEVICE fi if [ ! -f /var/adm/messages ]; then /usr/bin/cp /dev/null /var/adm/messages /usr/bin/chmod 0644 /var/adm/messages fi /usr/sbin/syslog-ng >/dev/msglog 2>&1 & fi ;; 'stop') echo 'syslog-ng service stopping.' if [ -f /var/run/syslog-ng.pid ]; then syspid=`/usr/bin/cat /var/run/syslog-ng.pid` [ "$syspid" -gt 0 ] && kill -15 $syspid fi ;; *) echo "Usage: $0 { start | stop }" exit 1 ;; esac ------------------------------------------ Jesse Keefe <jesse.keefe(a)convergys.com> | Systems Administrator | Convergys Corp. | 229 West Seventh Street | P.O. Box 1638 | Cincinnati, Oh 45201 | (513)723-3689 | -- NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected.

3 4

Logging to mysql
by Richard Wallace 22 Jan '02

22 Jan '02

Hello, I've setup a rule to send all log messages received for the local0 facility to a program which then inserts info into a local mysql database. The problem is this isn't working. The script doesn't appear to be being called, since there are no messages in the mysql.log file stating that anyone has tried to connect. Here are the lines I've added. Any help would be greatly appreciated. destination local0 { program("/usr/local/sbin/rsynclog.pl"); }; filter f_local0 { facility(local0); }; log { source(src); filter(f_local0); destination(local0); }; Thanks -- _ Richard Wallace /\ | | /\ /| AIM, Inc. (www.a--i--m.com) / \ | | / \ / | Information Systems Consultants \ \ | | \ \ / | / \ | | | \ / | "Providing New Technology, / /\ \ | | | \ / | the Old-Fashioned Way" / / \ \ | | | |\ \//| | / / /\ \ \ | | | | \ / | | / / \/ \ / | | | | \/ | | \/ \/ |_| |_| |___|

1 0

Re: Re: [syslog-ng]syslog-ng mistreating data as part of the hos tname ?
by Hildenbrand, Patrick 20 Jan '02

20 Jan '02

On Wed, Jan 16, 2002 at 07:45:26PM +0100, Nate Campi wrote: >On Wed, Jan 16, 2002 at 05:14:11PM +0100, Hildenbrand, Patrick wrote: >> some more info. >> >> tracing the output of the SSR, the packet does not contain the hostname at >> the proper place but only the timestamp. So the output looks like >> (translated into ascii): >> <174>Jan 13 04:02:12 %ACL_LOG-I-DENY, ACL [280] on "rtfa" UDP 192.168.1.2:4721 -> 14.9.1.3:53 this is the ascii converted hexdump of the package, there is only a single space between date and message. > [ ... ] > >Linux syslog sends messages like this: > ><123>named[123]: another error from BIND, you should use djbdns my debugging showed the prio beeing only two digits (ex. <23>) but yes and the difference is, there is even no timestamp, why this case is explicitly covered in the RFC, while the case of the cabeltron ssr is not. This is probably also why syslog-ng does not have a problem with this case, it gets logged as: Jan 17 08:11:21 hwdf0006/hwdf0006 PAM_pwdb[22525]: (sshd) session close so syslog-ng correctly adds time and hostname to the log entry. The format of linux (and others) is: <Prio>message The format of the SSR is: <Prio>datetime<space>message The format the RFC suggests is: <Prio>datetime{space}hostname{space}message >It is up to the relay/collector to input the complete header. this is my understanding from the rfc too, but how do I get this using syslog-ng ? >I missed the beggining of this thread, is "%ACL_LOG-I-DENY" getting set >as your hostname? I had the same problem with solaris logs when the >"TAG" field had a space in it, so syslog-ng (correctly) thinks the first >part of the process name (in the "TAG") was the hostname. I wrote a >syslog proxy to overcome this, since I can't ask syslog-ng to stop >following standards. as said above, there is one space between date and message but according to the standard, there is no standard on how devices do send their messages >Perhaps syslog-ng can have a configuration setting where if it receives >a certain string in the hostname field, you can set keep-hostname to no >for just that message. That would save the day for me, but I don't know >how hard it would be to implement that. Well I would vote for getting a setting just the other way around, so for being able to configure something like options( addhostname(<pattern>) which would lead to the hostname being added if the pattern is matched and the pattern then being treated as part of the message. For me this just would be a '^%' as every message of the ssr is prepended with the percent sign ;-) still do not know how much work it would be but ..... BTW: I do not know how the linux syslog does it, but it does not have this problem. Maybe because '%' is not a valid char for hostnames. linux syslog is a pretty standard syslog I'd guess, though you could argue, wether this is correct according to the standard. Linux syslog displays the message above as: Jan 13 04:02:12 1.2.3.4 %ACL_LOG-I-DENY, ACL [280] on "rtfa" UDP 192.168.1.2:4721 -> 14.9.1.3:53 so it automagically adds the ip address to the message. Again maybe because of the '%' and ',' signs inside the string at the <hostname> position. >-- >Nate Campi <http://www.campin.net> GnuPG key: 0xC17AEF79 Kind regards, Patrick Hildenbrand > Patrick Hildenbrand > Operations & Technology > SAP Hosting AG & Co. KG > Raiffeisenring 45 > 68789 St. Leon-Rot, Germany > T +49/6227/7-66410 > F +49/6227/7-66301 > E patrick.hildenbrand(a)sap.com > http://www.saphosting.com >

3 3

Leaky syslog-ng files?
by Rob Mitzel 20 Jan '02

20 Jan '02

Hi everyone, I'm pretty new to syslog-ng, but I really like it so far, except for one thing I can't figure out...(it could be a clueless newbie issue.) I'm using syslog-ng on FreeBSD 4.4 to log everything for about 10 cisco routers/switches right now, with about 30 more that will be added over the next week or two. I have them logging to separate files right now, and that works great, with newsyslog archiving stuff, etc etc. Works wonderfully. However, everything keeps leaking into my /var/log/messages file, which I don't want it to do. I *just* want it in their separate files. An example of what I use for filters is: filter f_gig2 { host("gig2-0"); }; And for log: log { source(src); filter(f_gig2); destination(gig2); }; And for destination: destination gig2 { file("/var/log/peer1/vancouver/gig2-0"); }; Anyone have any suggestions? Thanks in advance! -Rob.

1 0

Leaky syslog-ng files?
by Rob Mitzel 20 Jan '02

20 Jan '02

Hi everyone, I'm pretty new to syslog-ng, but I really like it so far, except for one thing I can't figure out...(it could be a clueless newbie issue.) I'm using syslog-ng on FreeBSD 4.4 to log everything for about 10 cisco routers/switches right now, with about 30 more that will be added over the next week or two. I have them logging to separate files right now, and that works great, with newsyslog archiving stuff, etc etc. Works wonderfully. However, everything keeps leaking into my /var/log/messages file, which I don't want it to do. I *just* want it in their separate files. An example of what I use for filters is: filter f_gig2 { host("gig2-0"); }; And for log: log { source(src); filter(f_gig2); destination(gig2); }; And for destination: destination gig2 { file("/var/log/peer1/vancouver/gig2-0"); }; Anyone have any suggestions? Thanks in advance! -Rob.

1 0

[Michael.Earls@chmcc.org: syslog-ng logging to mysql database]
by Balazs Scheidler 18 Jan '02

18 Jan '02

----- Forwarded message from Michael Earls <Michael.Earls(a)chmcc.org> ----- From: "Michael Earls" <Michael.Earls(a)chmcc.org> To: <syslog-ng-admin(a)lists.balabit.hu> Subject: syslog-ng logging to mysql database Date: Thu, 17 Jan 2002 12:10:19 -0500 ALL Ż I found a way to use syslog-ng to log to a mysql database, using syslog-ng template. I am writing a mini man page, the first draft is up if you want to check it out.. http://www.vermeer.org Thanks everyone for your help, Michael Earls ----- End forwarded message ----- -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Re: [syslog-ng]syslog-ng mistreating data as part of the hostname ?
by Hildenbrand, Patrick 16 Jan '02

16 Jan '02

some more info. tracing the output of the SSR, the packet does not contain the hostname at the proper place but only the timestamp. So the output looks like (translated into ascii): <174>Jan 13 04:02:12 %ACL_LOG-I-DENY, ACL [280] on "rtfa" UDP 192.168.1.2:4721 -> 14.9.1.3:53 The format as described in rfc3164 is only required for relays, which the router is not, as it is the originator of the packet. In fact in the standard it reads: 4.2 Original syslog Packets Generated by a Device There are no set requirements on the contents of the syslog packet as it is originally sent from a device. It should be reiterated here that the payload of any IP packet destined to UDP port 514 MUST be considered to be a valid syslog message. It is, however, RECOMMENDED that the syslog packet have all of the parts described in Section 4.1 - PRI, HEADER and MSG - as this enhances readability by the recipient and eliminates the need for a relay to modify the message. Setting 'keep_hostname(yes)', the message will be displayed correctly but without the hostname (contrary to the normal linux syslog). I could not fiddle out a single set of options that would have given me the output of the standard syslog. Any hints what I can do besides calling an external Program ? Mit besten Grüssen, Kind regards, Patrick Hildenbrand > Patrick Hildenbrand > Operations & Technology > SAP Hosting AG & Co. KG > Raiffeisenring 45 > 68789 St. Leon-Rot, Germany > T +49/6227/7-66410 > F +49/6227/7-66301 > E patrick.hildenbrand(a)sap.com > http://www.saphosting.com >

2 1

Re: [syslog-ng]syslog-ng
by Michael Earls 16 Jan '02

16 Jan '02

I will make things very clear on what i am trying to do with syslog-ng,, i have 200 routers and i want them to all point to my syslog server, that is why i created a sep file for each router, how can i get them to log to a mysql databse, i have tried just loggin one ip to the databse useing sqlsyslogd tables but that did not work, How can I go about getting this to work,?? thanks michael >>> nate(a)campin.net 01/14/02 08:06PM >>> On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier." _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

logging T3 messages to central loghost?
by KONSTANTIN GINZBURG 16 Jan '02

16 Jan '02

Does anybody have experience with logging T3 array messages to a central loghost? I'm running syslog-ng on the central loghost. I have my loglevel set to '3' on the T3 and the following line in /etc/syslog.conf on the T3 (I also have corresponding line in /etc/hosts): *.notice central_loghost In syslog-ng.conf on 'central_loghost' I have: source external { tcp(port(1999) max-connections(50)); }; source external_udp { udp(port(514)); }; filter f_udp { host("some_name") or host("T3_array_name"); }; destination hosts { file("/var/log/$HOST/$FACILITY/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) create_dirs(yes)); }; log { source(external); destination(hosts); }; log { source(external_udp); destination(hosts); }; In other words I'm listening on TCP port 1999 for all hosts except for special cases like T3 (because I don't know any way to make it send its logs via tcp). However, I don't get anything from the T3 array on the central log host even though local 'syslog' on the T3 gets a lot of messages. Am I missing something? I would appreciate any ideas or suggestions. Thanks in advance. Konstantin Ginzburg UNIX Engineering Eagan COSC (651) 406-2614

1 0

Conditional Logic
by jesse.keefe＠convergys.com 16 Jan '02

16 Jan '02

David hit it on the head. The messages I receive are on two seperate lines. The daemon calls for MountTape and on the next line I will get an "open failed". I understand the idea of swatch, we use it here, but I'm trying to kill two birds here. Syslog-ng has the capability of replacing swatch, I've already . I probably could write a small program to evaluate the MountTape, but I was hoping for a simpler solution. Jesse Keefe Analyst Convergys Corp -- NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected.

1 0

iptables and /v/l/messages
by greg whorley 16 Jan '02

16 Jan '02

I got syslog-ng to log iptables messages to /v/l/iptables using match(IN=) and it works fine. However, I still get iptables messages in /v/l/messages because, well, it's supposed to log all info level messages there. I changed my firewall script so that --log-level is 7 (debug) instead of 6 (info). I tested, and the messages are still logging to /v/l/messages. There is no filter for level(debug), only level(info). I bet there is a simple resolution to this. Can anyone help? -- _______________________________________________ Sign-up for your own FREE Personalized E-mail at Mail.com http://www.mail.com/?sr=signup 1 cent a minute calls anywhere in the U.S.! http://www.getpennytalk.com/cgi-bin/adforward.cgi?p_key=RG9853KJ&url=http:/…

1 0

Conditional logic
by jesse.keefe＠convergys.com 15 Jan '02

15 Jan '02

I'm running syslog-ng 1.4.14. I'm running Netbackup and I'm having certain messages paged out to certain people. Is there a way to have a filter use conditional logic? ie: Here are the messages I'm interested in: Jan 15 12:47:25 linen/linen tldd[25799]: [ID 992021 daemon.notice] TLD(0) MountTape CVG121 on drive 5, from slot 20 5 Jan 15 12:47:45 linen/linen tldd[26280]: [ID 302958 daemon.notice] TLD(0) open failed in io_open, I/O error What I would like to do is have the Mount Tape matched and if it fails page someone. If it passes, just continue on. Any ideas? Jesse Keefe Analyst Convergys Corp -- NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected.

3 3

logging by IP
by Chuck Kelly 15 Jan '02

15 Jan '02

Anyone know how to get syslog-ng to log to /var/log/<Source_ip> instead of /var/log/$HOST ?? I have routers, switches, UNIX hosts with different log formats and as a result, I get funky directories created like 04DA, VPN, etc. Unless there is a way to prevent the funky directories from being created. -- Chuck

2 1

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

I will make things very clear on what i am trying to do with syslog-ng,, i have 200 routers and i want them to all point to my syslog server, that is why i created a sep file for each router, how can i get them to log to a mysql databse, i have tried just loggin one ip to the databse useing sqlsyslogd tables but that did not work, what would be the best way for me to do this, and how do i do this, thanks michael >>> nate(a)campin.net 01/14/02 08:06PM >>> On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier." _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

how to make program destination
by David Monk 15 Jan '02

15 Jan '02

I am fairly new to central logging with syslog-ng and had a couple questions. I tried briefly looking to the mailing list archives, but I couldn't find any way to easily search it. I want to have some matched log entries from various hosts sent to the network admin staff. What would be most preferential is to have the source hostname in the subject line and the log message as the body. I defined the following: destination d_mail { program("mail -s \"Matched log entry from $HOST\" syslog); }; With this I DO get an email, but the $HOST macro is empty and the message body is also empty. Is there a better method? Or can anyone help with an example or two? Thanks, David Monk CCNA, MCSE david(a)purplebear.net

1 0

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

what do u think about this one, b/c i still can not get to to log to the mysql database, destination rrrouter { program("/usr/bin/mysql -u root -p -D rrrouter -t"); }; filter f_192.168.3.254 { host(192.168.3.254); }; log { source(net); filter(f_192.168.3.254); destination(rrrouter); }; thanks michael >>> nate(a)campin.net 01/14/02 20:16 PM >>> On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier." _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

Ok -- this is what i came up with ,, i am able to get syslog-ng to run b/c it does like like "program" thats if i am correct. destination rrouter { program("/usr/bin/mysql -u root -D rrrouter -t -p")}; filter f_192.168.3.254 { host(192.168.3.254); }; log { source(net); filter(f_192.168.3.254); destination(rrrouter); }; thanks michael >>> nate(a)campin.net 01/14/02 20:16 PM >>> On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier." _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

so u are saying that i can write something like this ## tking switch 192.168.3.254 destination 192.168.3.254 {program("/usr/bin/mysql -u sysloguser -t logs 192.168.3.254 -p")}; filter f_192.168.3.254 { host(192.168.3.254); }; log { source(net); filter(f_192.168.3.254); destination(192.168.3.254); }; the databse is logs and the table is 192.168.3.254, am i correct, thanks michael >>> Nate Campi <nate(a)campin.net> 01/14/02 20:07 PM >>> On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier."

1 0

Re: [syslog-ng]syslog-ng
by Nate Campi 15 Jan '02

15 Jan '02

On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier."

1 0

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, do u have an example syslog-ng file and mysql database? mearls >>> nate(a)campin.net 01/14/02 17:57 PM >>> On Mon, Jan 14, 2002 at 04:49:46PM -0500, Michael Earls wrote: > Hi -- i am new here, and was not sure if this has been posted > > i am trying to use syslog-ng to log to a mysql datase, i was told that i could pipe or use program, but i do not know how to, > > my syslog-ng file is very basic, i am adding lines to create sep files like this for each router, is there a way to just pipe this to a mysql database. I put up some pointers on this stuff at http://www.campin.net/newlogcheck.html -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "Whom computers would destroy, they must first drive mad." -Anon. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, do u have an example syslog-ng file and mysql database? mearls >>> nate(a)campin.net 01/14/02 17:57 PM >>> On Mon, Jan 14, 2002 at 04:49:46PM -0500, Michael Earls wrote: > Hi -- i am new here, and was not sure if this has been posted > > i am trying to use syslog-ng to log to a mysql datase, i was told that i could pipe or use program, but i do not know how to, > > my syslog-ng file is very basic, i am adding lines to create sep files like this for each router, is there a way to just pipe this to a mysql database. I put up some pointers on this stuff at http://www.campin.net/newlogcheck.html -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "Whom computers would destroy, they must first drive mad." -Anon. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

syslog-ng
by Michael Earls 14 Jan '02

14 Jan '02

Hi -- i am new here, and was not sure if this has been posted i am trying to use syslog-ng to log to a mysql datase, i was told that i could pipe or use program, but i do not know how to, my syslog-ng file is very basic, i am adding lines to create sep files like this for each router, is there a way to just pipe this to a mysql database. ### ### 7206-core ### destination 192.168.1.245 { file("/var/log/routers/7206-core.log"); }; filter f_192.168.1.245 { host(192.168.1.245); }; log { source(net); filter(f_192.168.1.245); destination(192.168.1.245); }; ## main router destination 192.168.1.1 { file("/var/log/routers/main-rr.log"); }; filter f_192.168.1.1 { host(192.168.1.1); }; log { source(net); filter(f_192.168.1.1); destination(192.168.1.1); }; ## switch 192.168.1.254 destination 192.168.1.254 { file("/var/log/routers/michaeleaarls-switch.log"); }; filter f_192.168.1.254 { host(192.168.1.254); }; log { source(net); filter(f_192.168.1.254); destination(192.168.1.254); }; ### ### this should work... ### ## tony kings router destination 192.168.3.1 { file("/var/log/routers/tking-main.log"); }; filter f_192.168.3.1 { host(192.168.3.1); }; log { source(net); filter(f_192.168.3.1); destination(192.168.3.1); }; ## tking switch 192.168.3.254 destination 192.168.3.254 { file("/var/log/routers/tking-switch.log"); }; filter f_192.168.3.254 { host(192.168.3.254); }; log { source(net); filter(f_192.168.3.254); destination(192.168.3.254); };

2 1

syslog-ng mistreating data as part of the hostname ?
by Hildenbrand, Patrick 14 Jan '02

14 Jan '02

Hi everybody, getting logs from cabeltron ssr's into syslog-ng, we've some trouble. The data sent (the was syslog will fromat it) is like the line below: Jan 13 04:02:12 loghost %ACL_LOG-I-DENY, ACL [280] on "rtfa" UDP 192.168.1.2:4721 -> 14.9.1.3:53 using options keep_hostname(no); long_hostnames(no); chain_hostnames(on) syslog-ng presents us: Jan 13 04:02:12 %ACL_LOG-I-DENY,/loghost ACL [280] on "rtfa" UDP 192.168.1.2:4721 -> 14.9.1.3:53 changing chain_hostnames to off, we even get: Jan 13 04:02:12 loghost ACL [280] on "rtfa" UDP 192.168.1.2:4721 -> 14.9.1.3:53 so the important part about what happend to the router is lost (all messages on the cabletron routers are formatted like this). It appears to me as if syslog-ng while parsing adds the first value of the message to the hostname. Is there some configuration setting to disable this ? BTW: this is using 1.4.11 as well as with 1.5.13 Kind regards, Patrick Hildenbrand

1 0

Making Logs Viewable as a Webpage
by Aaron Brown 14 Jan '02

14 Jan '02

First off, Congrats on making an awesome utility. I've used it in 2 nationwide networks utilizing over 200 Routers, servers and network appliances and its run rock solid. But I would like to make the logs viewable via a webpage for security purposes. Unfortunately the Logs come out as a continuous line when viewed as html. Basically I'd like to be able to add a html page break ,<br>, to the end of each log message as they are written. I'm sure its an easy fix, but I am by no means a programmer. If possible could you tell me which src file and line that holds the command that writes the actual syslog message to the file. Any help would be appreciated. Aaron

3 2

Re: syslog-ng digest, Vol 1 #612 - 6 msgs
by wireless 13 Jan '02

13 Jan '02

Dear Krishna, Seems that there is conflict in your installation. To install syslog-ng I recommend that u first install the libol. get the libol tar.gz file from the http://www.balabit.hu/en/downloads/syslog-ng/downloads/ . Choose suitable one. After installing the libol, proceed with the syslog-ng installation. Any difficulties? Do write it in again. Best Regards, Anup Sainju WorldLink Communications Kathmandu Nepal wireless(a)wlink.com.np www.wlink.com.np snalbh> Krishna wrote: snalbh> Hi, snalbh> I have been trying to install syslog-ng and during this phase I got snalbh> lot of error's.After installing libol I tried to install but thus time i snalbh> gave the path to where libol-config was. I got the binary file snalbh> syslog-ng in the src directory. snalbh> But when I do make install it says "noting to be done in this directory" snalbh> and quit. snalbh> I am not getting syslog-ng.conf in the /etc.There is no directory of snalbh> syslog-ng in the /etc directory snalbh> Please Help snalbh> Any help would be appreciated snalbh> regards snalbh> Krishna Shekhar snalbh> Network Administrator snalbh> Wiplash.com snalbh> http://wiplash2000.com snalbh> _______________________________________________ snalbh> --__--__-- snalbh> Message: 2 snalbh> Date: Fri, 11 Jan 2002 18:00:55 +0545 snalbh> From: wireless <wireless(a)wlink.com.np> snalbh> Reply-To: wireless <wireless(a)wlink.com.np> snalbh> Organization: Worldlink Communnications snalbh> To: syslog-ng(a)lists.balabit.hu snalbh> Subject: [syslog-ng]to receive log messages from remote terminals. snalbh> Reply-To: syslog-ng(a)lists.balabit.hu snalbh> Hello syslog-ng, snalbh> What should I fix in the conf file to receive log messages from snalbh> remote terminals. snalbh> Best regards, snalbh> wireless mailto:wireless@wlink.com.np snalbh> --__--__-- snalbh> Message: 3 snalbh> From: "Ohrberg, Mick" <Mick.Ohrberg(a)umb.com> snalbh> To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> snalbh> Subject: RE: [syslog-ng]INSTALLATION PROBLEM <Can't get /etc/syslog-ng/sys log-ng.conf>>PLEASE HELP!!!!!! snalbh> Date: Fri, 11 Jan 2002 06:35:36 -0600 snalbh> charset="iso-8859-1" snalbh> Reply-To: syslog-ng(a)lists.balabit.hu snalbh> Krishna, snalbh> If there is no /etc/syslog-ng/syslog-ng.conf, I suggest you create one. snalbh> /Mick >> -----Original Message----- >> From: Krishna [mailto:Krishna_shekhar@gmx.net] >> Sent: Thursday, January 10, 2002 4:27 PM >> To: syslog-ng(a)lists.balabit.hu >> Subject: [syslog-ng]INSTALLATION PROBLEM <Can't get >> /etc/syslog-ng/syslog-ng.conf>PLEASE HELP!!!!!! >> >> >> >> >> Krishna wrote: >> >> Hi, >> I have been trying to install syslog-ng and during this >> phase I got >> lot of error's.After installing libol I tried to install but >> thus time i >> gave the path to where libol-config was. I got the binary file >> syslog-ng in the src directory. >> But when I do make install it says "noting to be done in >> this directory" >> and quit. >> I am not getting syslog-ng.conf in the /etc.There is no directory of >> syslog-ng in the /etc directory >> Please Help >> Any help would be appreciated >> >> regards >> Krishna Shekhar >> Network Administrator >> Wiplash.com >> snalbh> http://wiplash2000.com snalbh> _______________________________________________ snalbh> _______________________________________________ snalbh> syslog-ng maillist - syslog-ng(a)lists.balabit.hu snalbh> https://lists.balabit.hu/mailman/listinfo/syslog-ng snalbh> --__--__-- snalbh> Message: 4 snalbh> Date: Fri, 11 Jan 2002 09:49:18 -0500 snalbh> From: "Paul C. Williamson" <pwilliamson(a)mandtbank.com> snalbh> To: <syslog-ng(a)lists.balabit.hu> snalbh> Subject: [syslog-ng]Accepting messages from all devices (including Cisco) snalbh> Reply-To: syslog-ng(a)lists.balabit.hu snalbh> Ok, now that I've got it installed and running (thanks to all who snalbh> helped)...I have yet another question. snalbh> When starting syslog-ng (I'm on RedHat 7.2), it just reports that it snalbh> is starting Kernel Logger, but never reports that syslog-ng started. snalbh> Is this normal? snalbh> What am I missing? I modified the init.d script for syslog-ng and put it in the /etc/rc.d/init.d directory, and put syslog-ng.conf.RedHat into snalbh> /etc/syslog-ng directory. snalbh> I was also capturing all Cisco devices on my network with syslog, so snalbh> I added: snalbh> destination ciscol { file("/var/log/cisco.log"); }; snalbh> log { source(src1); filter(ciscof); destination(ciscol);}; snalbh> To capture all the cisco stuff. I did not modify the facility on the Cisco devices, but they are all set to source-interface loopback0. snalbh> Any ideas? snalbh> Thanks, snalbh> Paul snalbh> --__--__-- snalbh> Message: 5 snalbh> Date: Fri, 11 Jan 2002 09:30:12 -0700 snalbh> From: Brad Arlt <arlt(a)cpsc.ucalgary.ca> snalbh> To: syslog-ng(a)lists.balabit.hu snalbh> Subject: Re: [syslog-ng]INSTALLATION PROBLEM <Can't get /etc/syslog-ng/syslog-ng.conf>PLEASE HELP!!!!!! snalbh> Reply-To: syslog-ng(a)lists.balabit.hu snalbh> On Fri, Jan 11, 2002 at 03:57:17AM +0530, Krishna wrote: >> I have been trying to install syslog-ng and during this phase I got >> lot of error's.After installing libol I tried to install but thus time i >> gave the path to where libol-config was. I got the binary file >> syslog-ng in the src directory. >> But when I do make install it says "noting to be done in this directory" >> and quit. snalbh> I am not certain that "make install" does anthing. I have never snalbh> bothered to run it. Just "cp" the syslog-ng executable wherever you snalbh> feel like putting it. If you made libol dynamic, make sure it is snalbh> copied to the appropriate place as well. If you are uncertian whether snalbh> you need to copy libol use "ldd" on the syslog-ng executable. If you snalbh> see libol in the dynamic dependancy list, then you will need to snalbh> install libol. >> I am not getting syslog-ng.conf in the /etc. There is no directory of >> syslog-ng in the /etc directory >> Please Help >> Any help would be appreciated snalbh> You need to make your own syslog-ng.conf file. There are examples in snalbh> the doc directory of the syslog-ng source distribution (or there was snalbh> in the 1.4.x distribution). You will almost certainly have to alter snalbh> the samples, please consult the documentation to figure out how. snalbh> mkdir -p -m 750 /etc/syslog-ng snalbh> should solve your latter problem. snalbh> ---------------------------------------------------------------------------- snalbh> __o Bradley Arlt Security Team Lead snalbh> _ \<_ arlt(a)cpsc.ucalgary.ca University Of Calgary snalbh> (_)/(_) http://pages.cpsc.ucalgary.ca/~arlt/ Computer Science snalbh> --__--__-- snalbh> _______________________________________________ snalbh> syslog-ng maillist - syslog-ng(a)lists.balabit.hu snalbh> https://lists.balabit.hu/mailman/listinfo/syslog-ng snalbh> End of syslog-ng Digest -- Best regards, wireless mailto:wireless@wlink.com.np

1 0