- syslog-ng - lists.balabit.hu

INSTALLATION PROBLEM <Can't get /etc/syslog-ng/syslog-ng.conf>PLEASE HELP!!!!!!
by Krishna 11 Jan '02

11 Jan '02

Hi, I have been trying to install syslog-ng and during this phase I got lot of error's.After installing libol I tried to install but thus time i gave the path to where libol-config was. I got the binary file syslog-ng in the src directory. But when I do make install it says "noting to be done in this directory" and quit. I am not getting syslog-ng.conf in the /etc.There is no directory of syslog-ng in the /etc directory Please Help Any help would be appreciated regards Krishna Shekhar Network Administrator Wiplash.com http://wiplash2000.com

2 2

Accepting messages from all devices (including Cisco)
by Paul C. Williamson 11 Jan '02

11 Jan '02

Ok, now that I've got it installed and running (thanks to all who helped)...I have yet another question. When starting syslog-ng (I'm on RedHat 7.2), it just reports that it is starting Kernel Logger, but never reports that syslog-ng started. Is this normal? What am I missing? I modified the init.d script for syslog-ng and put it in the /etc/rc.d/init.d directory, and put syslog-ng.conf.RedHat into /etc/syslog-ng directory. I was also capturing all Cisco devices on my network with syslog, so I added: destination ciscol { file("/var/log/cisco.log"); }; log { source(src1); filter(ciscof); destination(ciscol);}; To capture all the cisco stuff. I did not modify the facility on the Cisco devices, but they are all set to source-interface loopback0. Any ideas? Thanks, Paul

1 0

RE: [syslog-ng]INSTALLATION PROBLEM <Can't get /etc/syslog-ng/sys log-ng.conf>PLEASE HELP!!!!!!
by Ohrberg, Mick 11 Jan '02

11 Jan '02

Krishna, If there is no /etc/syslog-ng/syslog-ng.conf, I suggest you create one. /Mick > -----Original Message----- > From: Krishna [mailto:Krishna_shekhar@gmx.net] > Sent: Thursday, January 10, 2002 4:27 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]INSTALLATION PROBLEM <Can't get > /etc/syslog-ng/syslog-ng.conf>PLEASE HELP!!!!!! > > > > > Krishna wrote: > > Hi, > I have been trying to install syslog-ng and during this > phase I got > lot of error's.After installing libol I tried to install but > thus time i > gave the path to where libol-config was. I got the binary file > syslog-ng in the src directory. > But when I do make install it says "noting to be done in > this directory" > and quit. > I am not getting syslog-ng.conf in the /etc.There is no directory of > syslog-ng in the /etc directory > Please Help > Any help would be appreciated > > regards > Krishna Shekhar > Network Administrator > Wiplash.com > http://wiplash2000.com _______________________________________________ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

to receive log messages from remote terminals.
by wireless 11 Jan '02

11 Jan '02

Hello syslog-ng, What should I fix in the conf file to receive log messages from remote terminals. Best regards, wireless mailto:wireless@wlink.com.np

1 0

How to run syslog-ng
by Paul C. Williamson 11 Jan '02

11 Jan '02

I know I must be missing something... The docs aren't real clear on this, but to I remove the syslogd daemon and replace it with syslog-ng? I am able to compile it, but there isn't anything that says how to run it. Also, is there an archive of the mailing list? Thanks, Paul

2 1

RE: [syslog-ng]How to run syslog-ng
by Ohrberg, Mick 10 Jan '02

10 Jan '02

Paul, I have run them both in parallel, but the general idea is to stop using syslogd - syslog-ng is a replacement. /Mick > -----Original Message----- > From: Paul C. Williamson [mailto:pwilliamson@mandtbank.com] > Sent: Thursday, January 10, 2002 2:48 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]How to run syslog-ng > > > I know I must be missing something... > > The docs aren't real clear on this, but to I remove the > syslogd daemon > and replace it with syslog-ng? > > I am able to compile it, but there isn't anything that says > how to run it. > > Also, is there an archive of the mailing list? > > Thanks, > Paul > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

RE: [syslog-ng]Messages from AIX 4.3.2 syslog always 'forwarded'
by Douwe Dijkstra 09 Jan '02

09 Jan '02

> > I just installed syslog-ng on a central loghost and it > seems to think that > > messages from AIX systems are 'forwarded'. > > > > Messages from AIX machines look like: > > Jan 4 10:00:20 pg forwarded from pg: > > > > Messages from Solaris machines look like: > > Jan 3 17:16:41 mailhost sshd[1386]: > > > > What is wrong here? > > It might be hostname chaining, but I seem to recall another AIX person > was having this issue a while ago. I would look the the mailing list > archive to see if the answer isn't there. I don't look after any AIX > boxes so I try not to remember these sorts of things. The mailing list archive is not searchable, so I browsed a few months back. Couldn't find anything usefull. Douwe

1 0

RE: [syslog-ng]Messages from AIX 4.3.2 syslog always 'forwarded'
by Douwe Dijkstra 09 Jan '02

09 Jan '02

I added this option, and it did not work. Douwe > options { chain_hostnames(no); }; > > in the syslog-ng.conf file, I think I solved the problem with this. > > > ---------- > > Von: Douwe Dijkstra[SMTP:Douwe.Dijkstra@i-pay.com] > > Antwort an: syslog-ng(a)lists.balabit.hu > > Gesendet: Freitag, 4. Januar 2002 14:03 > > An: syslog-ng(a)lists.balabit.hu > > Betreff: [syslog-ng]Messages from AIX 4.3.2 syslog > always 'forwarded' > > > > Hi there! > > > > I just installed syslog-ng on a central loghost and it > seems to think that > > messages from AIX systems are 'forwarded'. > > > > Messages from AIX machines look like: > > Jan 4 10:00:20 pg forwarded from pg: > > > > Messages from Solaris machines look like: > > Jan 3 17:16:41 mailhost sshd[1386]: > > > > What is wrong here? > > > > FYI: Using syslog-ng 1.4.14 on Solarix x86 8.0, AIX client > machines are > > 4.3.2, Solaris client machines are x86 7.0 or 8.0. > > All machines are in the loghost host file. > > > > Douwe > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

Sudo logging
by Chuck Kelly 09 Jan '02

09 Jan '02

I can't seem to get sudo logs logging properly. Would like each host to log to sudo.log instead of local2. /var/log/syslog-ng/$HOST/sudo.log Anyone have any examples of how they did it? -- Chuck

2 1

logging to a central server
by Stephen C Burns 08 Jan '02

08 Jan '02

Hey all, Excuse the ignorance, first of all. I have always just used syslog/syslog-ng as logging sources on local machines, I've yet to use the network functionality. How exactly would one configure a host, so that it sends all logs to a central syslog-ng machine? I am using linux, I assume that I would just change the unix-stream to an IP address, or something of the source? Thanks in advance everyone.

3 2

no logging after HUP (1.5.13)
by Arnold Pulleman 05 Jan '02

05 Jan '02

Because of the template feature I want to use syslog-ng 1.5 on a FreeBSD 4.2 and 4.3 platform. While testing 1.5.13 I found a problem when sending a hangup signal to syslog-ng. The restart message is shown but nothing follows until syslog-ng is stopped and started again. My question is how to solve this problem? The following output of the messages file appeared: Oct 30 11:06:49 humble syslog-ng[5018]: syslog-ng version 1.5.13 starting Oct 30 11:08:56 humble su: BAD SU user to root on /dev/ttyp7 Oct 30 11:09:28 humble su: user to root on /dev/ttyp7 Oct 30 11:16:49 humble syslog-ng[5018]: STATS: dropped 0 Oct 30 11:25:09 humble su: BAD SU user to root on /dev/ttyp7 Oct 30 11:26:05 humble su: user to root on /dev/ttyp3 Oct 30 11:26:49 humble syslog-ng[5018]: STATS: dropped 0 Oct 30 11:27:00 humble syslog-ng[5018]: SIGHUP received, restarting syslog-ng Oct 30 11:35:36 humble syslog-ng[5109]: syslog-ng version 1.5.13 starting Oct 30 11:35:49 humble syslog-ng[5109]: SIGHUP received, restarting syslog-ng

4 6

Messages from AIX 4.3.2 syslog always 'forwarded'
by Douwe Dijkstra 04 Jan '02

04 Jan '02

Hi there! I just installed syslog-ng on a central loghost and it seems to think that messages from AIX systems are 'forwarded'. Messages from AIX machines look like: Jan 4 10:00:20 pg forwarded from pg: Messages from Solaris machines look like: Jan 3 17:16:41 mailhost sshd[1386]: What is wrong here? FYI: Using syslog-ng 1.4.14 on Solarix x86 8.0, AIX client machines are 4.3.2, Solaris client machines are x86 7.0 or 8.0. All machines are in the loghost host file. Douwe

2 1

AW: [syslog-ng]Messages from AIX 4.3.2 syslog always 'forwarded'
by Sippel, Christian 04 Jan '02

04 Jan '02

Hi Douwe, I'm not that shure about it but you could try options { chain_hostnames(no); }; in the syslog-ng.conf file, I think I solved the problem with this. Hope this helps, Regards, Christian > ---------- > Von: Douwe Dijkstra[SMTP:Douwe.Dijkstra@i-pay.com] > Antwort an: syslog-ng(a)lists.balabit.hu > Gesendet: Freitag, 4. Januar 2002 14:03 > An: syslog-ng(a)lists.balabit.hu > Betreff: [syslog-ng]Messages from AIX 4.3.2 syslog always 'forwarded' > > Hi there! > > I just installed syslog-ng on a central loghost and it seems to think that > messages from AIX systems are 'forwarded'. > > Messages from AIX machines look like: > Jan 4 10:00:20 pg forwarded from pg: > > Messages from Solaris machines look like: > Jan 3 17:16:41 mailhost sshd[1386]: > > What is wrong here? > > FYI: Using syslog-ng 1.4.14 on Solarix x86 8.0, AIX client machines are > 4.3.2, Solaris client machines are x86 7.0 or 8.0. > All machines are in the loghost host file. > > Douwe > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

RE: [syslog-ng]help
by Nicholas Berry 02 Jan '02

02 Jan '02

Here is an example script that I'm using for Solaris: ---SOF #!/bin/sh # syslog-ng start|stop|restart script USAGE="Usage: `basename $0` start|stop|restart" CFG="/usr/local/etc/syslog-ng.conf" PATH="/usr/bin:/usr/local/bin:/usr/sbin:/usr/local/sbin" LD_LIBRARY_PATH="/usr/lib:/usr/local/lib:/usr/local/ssl/lib" export LD_LIBRARY_PATH PATH case "$1" in 'start') if [ -f $CFG ]; then echo "Starting syslog-ng: " mount /syslog syslog-ng else echo "-syslog-ng failed! Missing configuration file." fi ;; 'stop') echo "Stopping syslog-ng: " pkill -x -u 0 syslog-ng rm /var/run/syslog-ng.pid 1>&2 echo "done." ;; 'restart') $0 stop $0 start ;; *) echo $USAGE 1>&2 exit 1 esac ---EOF Things you might want to change: 1. If you're not using Solaris, LD_LIBRARY_PATH is not needed 2. pkill is another Solaris specific reference, and can be replaced with "kill -9 `cat /var/run/syslog-ng.pid`" 3. If your syslog-ng.conf is located elsewhere, update the CFG variable. In order to have this start on (re)boot, place in your default run-level directory (most linux distros use /etc/rc?.d, redhat uses /etc/rc.d/rc?.d - rc3.d is most commonly the default). Name the file S99syslog-ng (the 99 can change to whatever you like). Hope that answers your question. Thanks, Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com -----Original Message----- From: Nocentino, Anthony [mailto:anocentino@cardioworks.net] Sent: Wednesday, October 10, 2001 10:22 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]help how do i config syslog-ng to start up automatically on boot _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]help
by Ohrberg, Mick 02 Jan '02

02 Jan '02

...or as an alternative, locate your /etc/rc2.d directory and put a file in there that's tied to /usr/local/sbin/syslog-ng and specify configfile. :) > -----Original Message----- > From: jamie rishaw [mailto:jamie@playboy.com] > Sent: Wednesday, January 02, 2002 9:16 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]help > > > On Wed, Oct 10, 2001 at 12:21:55PM -0500, Nocentino, Anthony wrote: > > how do i config syslog-ng to start up automatically on boot > > 1) You configure your workstation to be in the correct year. > 2) You install the auto boot dll. :) > 3) UNIX for dummies; you're trying to change out the onboard > sensors when > you apparently don't know how to even start the engine .. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

help
by Nocentino, Anthony 02 Jan '02

02 Jan '02

how do i config syslog-ng to start up automatically on boot

2 1

problems with file template directive
by Nathan Rawling 02 Jan '02

02 Jan '02

I'm attempted to use the template() option to specify the file format for a file destination, and I keep getting the error: parse error at 12 ...which isn't too helpful. Here is my syslog-ng.conf file: > > log { source(src); destination(all); }; > > source src { > udp(); > tcp(); > sun-streams("/dev/log" door("/etc/.syslog_door")); > internal(); > }; > > destination all { > file("/var/log/template" template("$FACILITY $PRIORITY $ISODATE $FULLHOST $PROGRAM $MESSAGE")); > file("/var/log/messages"); > }; Can anybody tell me what I'm doing wrong? I tried looking at the source code to figure out what was wrong, but I don't have any experience with yacc. Also, it would be useful if the template() directive could be used with the program() or pipe() destinations for what I'm working on. Perhaps I'll try and dig through the code to see how hard it would be to add that. Thanks in advance! Nathan

2 1

RE: [syslog-ng]What are the installation requirements???-<<New er ror>>>
by Ohrberg, Mick 02 Jan '02

02 Jan '02

Krishna, You need to set your LD_LIBRARY_PATH to include the path to wherever your libol libs are installed, as well as specify the include:s path to /usr/local/include (most likely) at compilation time. /Mick > -----Original Message----- > From: Krishna [mailto:krishna_shekhar@gmx.net] > Sent: Saturday, December 29, 2001 4:13 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]What are the installation > requirements???-<<New > error>>> > > > Hi, > I have already installed libol. > > regards > Krishna Shekhar > Network Administrator > Wiplash.com > ----- Original Message ----- > From: "Balazs Scheidler" <bazsi(a)balabit.hu> > To: <syslog-ng(a)lists.balabit.hu> > Sent: Saturday, December 29, 2001 2:55 PM > Subject: Re: [syslog-ng]What are the installation > requirements???-<<New > error>>> > > > > On Sat, Dec 29, 2001 at 02:37:22PM +0530, Krishna wrote: > > > Hi, > > > I got flex and bison installed. But after doing > make install I > got > > > the following errors > > > > install libol (also found at > http://www.balabit.hu/en/downloads/syslog-ng/) > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 > 9CFD 804E C82C > 8EB1 > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

AW: [syslog-ng]What are the installation requirements???
by Sippel, Christian 02 Jan '02

02 Jan '02

Hi, try following the instructions in the "install"-file which is part of the syslog-ng-package. <<Install>> Hope this helps, Christian > ---------- > Von: Krishna[SMTP:krishna_shekhar@gmx.net] > Antwort an: syslog-ng(a)lists.balabit.hu > Gesendet: Samstag, 22. Dezember 2001 10:20 > An: syslog-ng(a)lists.balabit.hu > Betreff: [syslog-ng]What are the installation requirements??? > > Hi, > I am new to syslog-ng. I wanted to know what are the installation > reqirements for this package to install.I tried to install it but got lot > of error's. > Please Help > > regards > Krishna Shekhar > Network Administrator > Wiplash.com >

1 0

RE: [syslog-ng]help
by Brian D. Olesen 02 Jan '02

02 Jan '02

> -----Original Message----- > From: Nocentino, Anthony [mailto:anocentino@cardioworks.net] > Sent: 10. oktober 2001 18:22 > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]help > > > how do i config syslog-ng to start up automatically on boot > > Please specify your OS platform. This is system dependant and has nothing to do with syslog-ng. Best regards, Brian D. Olesen Unix administrator

1 0

INSTALLATION PROBLEM--->>Please HELP!!! REDHAT6.0
by Krishna 01 Jan '02

01 Jan '02

Hi, I tried to install syslog-ng.I had earlier installed Bison and Flex.I even installed libol included with syslog-ng. Now when I do make install I get the following error's. I am using REDHAT6.0 In file included from main.c:26: syslog-ng.h:31:objects.h: No such file or directory In file included from cfg file.h:26: from main.c:27: sources.h:30:read_line.h:No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:io.h:No such file or directory I file included from cfgfile.h:29, from main.c:27: sources.h:33:list.h:No such file or directory main.c:29:format.h:No such file or directory main.c:30:werror.h:No such file or directory main.c:31:queue.h:No such file or directory Make[1]: [mai.o] Error1 Make[1] leaving directory '/usr/src/syslog-ng-1.4.14/src' Make: [Install-recursive] Error1 NOTE:I had to manually write these error's by making a note of it. What should I do now? Any help would be appreciated. regards Krishna Shekhar Network Administrator Wiplash2000.com

2 1

hospital
by Balazs Scheidler 01 Jan '02

01 Jan '02

Hi, As you might have noticed, I'm quite unresponsive these days. The reason for this is I was in hospital, and I have to go back this afternoon. I expect to be there for at least a week. I'll try to answer all messages as soon as I return. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

6 11

AW: [syslog-ng]What are the installation requirements???
by Sippel, Christian 29 Dec '01

29 Dec '01

Hi, as far as I understand your error messages flex and bison are missing. You have to install them if you have not done it yet. This is a quotation from the "install"-file of syslog-ng: Compiling the program: ====================== syslog-ng requires gcc as a C compiler (at least version 2.7.2), GNU flex as a lex, and bison as a parser generator. Some GNU C and GNU flex extensions are used, porting to other compilers/lex/yacc combination is welcome. Hope this helps, regards, Christian > ---------- > Von: Krishna[SMTP:krishna_shekhar@gmx.net] > Antwort an: syslog-ng(a)lists.balabit.hu > Gesendet: Freitag, 28. Dezember 2001 09:19 > An: syslog-ng(a)lists.balabit.hu > Betreff: Re: [syslog-ng]What are the installation requirements??? > > Hi, > These were the error's > loading cache ./config.cache checking for a BSD compatible install... > /usr/bin/install -c checking whether build environment is sane... yes > checking whether make sets ${MAKE}... yes checking for working aclocal... > missing checking for working autoconf... missing checking for working > automake... missing checking for working autoheader... missing checking > for > working makeinfo... missing checking whether build environment is sane... > yes checking for gcc... gcc checking whether the C compiler (gcc ) > works... > yes checking whether the C compiler (gcc ) is a cross-compiler... no > checking whether we are using GNU C... yes checking whether gcc > accepts -g... yes checking for gcc option to accept ANSI C... none needed > checking for bison... no checking for byacc... no checking how to run the > C > preprocessor... gcc -E > checking for flex... no > checking for lex... no > checking for flex... lex > checking for yywrap in -ll... no > checking lex output file root... > > Where should I get these package? I found an rpm for syslog-ng But the rpm > did not work because it said > it requires <= 3 soimething like that!! > > regards > Krishna Shekhar > Network Administrator > Wiplash.com > ----- Original Message ----- > From: "Ohrberg, Mick" <Mick.Ohrberg(a)umb.com> > To: <syslog-ng(a)lists.balabit.hu> > Sent: Thursday, December 27, 2001 7:38 PM > Subject: RE: [syslog-ng]What are the installation requirements??? > > > > Krishna, > > > > What were the errors? Did you get them during compilation, installation > or > > when trying to run syslog-ng? > > > > /Mick > > > > -----Original Message----- > > From: Krishna [mailto:krishna_shekhar@gmx.net] > > Sent: Saturday, December 22, 2001 4:37 AM > > To: Syslog-ng > > Subject: [syslog-ng]What are the installation requirements??? > > > > > > Hi, > > I am new to syslog-ng. I wanted to know what are the installation > > reqirements for this package to install.I tried to install it but got > lot > of > > error's. > > Please Help > > > > regards > > Krishna Shekhar > > Network Administrator > > Wiplash.com > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

3 3

verion info
by Matthew Schumacher 29 Dec '01

29 Dec '01

Hello, What is the version difference between the 1.4 and 1.5 versions of syslog-ng. Is the odd number denote a beta branch. Thanks, schu -- ______________________________________________________________________ Matthew Schumacher matt.s(a)aptalaska.net Alaska Power and Telephone desk: 907-563-2199 x223 Systems Administrator cell: 907-240-2275

1 0

RE: [syslog-ng]What are the installation requirements???
by Ohrberg, Mick 28 Dec '01

28 Dec '01

Krishna, What were the errors? Did you get them during compilation, installation or when trying to run syslog-ng? /Mick -----Original Message----- From: Krishna [mailto:krishna_shekhar@gmx.net] Sent: Saturday, December 22, 2001 4:37 AM To: Syslog-ng Subject: [syslog-ng]What are the installation requirements??? Hi, I am new to syslog-ng. I wanted to know what are the installation reqirements for this package to install.I tried to install it but got lot of error's. Please Help regards Krishna Shekhar Network Administrator Wiplash.com

2 1

pings from loghost
by Sippel, Christian 27 Dec '01

27 Dec '01

Dear list, I have set up a loghost using syslog-ng 1.4.14 on an AIX-Box. Now there is the phenomenon that the loghost tries to send ICMP echo requests (= pings) to machines from which it is receiving logs. Those pings are blocked by a firewall which is located between the loghost and the other computers. How can I stop the syslog-ng-machine from sending these pings? They are obviously not necessary for the proper work of syslog-ng as the loghost works very well even when the pings are blocked. Thanks in advance, regards, Christian

3 2

one thing could better (i think so)
by Lukasz Wojtow 27 Dec '01

27 Dec '01

Hi! Syslog-n is great, but I have one suggestion what could be better: when new configuration starts and there is an error in config file, syslog writes to log message like: "Syntax error reading config file, using old configuration". Yea... but where is this error? I have configured syslog-ng with few hundreds lines and i haved an error somewhere :/ Couldn't syslog write a line number where an error occured? Best regards, Lukasz Wojtow ps. an error was "filteer" instead "filter" :)

2 2

Kellemes �nnepeket!
by info＠delton.hu 24 Dec '01

24 Dec '01

Kellemes Karácsonyi Ünnepeket és Eredményekben Gazdag, Boldog Új Évet Kívánunk! DELTON www.delton.hu

1 0

What are the installation requirements???
by Krishna 22 Dec '01

22 Dec '01

Hi, I am new to syslog-ng. I wanted to know what are the installation reqirements for this package to install.I tried to install it but got lot of error's. Please Help regards Krishna Shekhar Network Administrator Wiplash.com

1 0

What are the installation requirements???
by Krishna 22 Dec '01

22 Dec '01

Hi, I am new to syslog-ng. I wanted to know what are the installation reqirements for this package to install.I tried to install it but got lot of error's. Please Help regards Krishna Shekhar Network Administrator Wiplash.com

1 0

RE: [syslog-ng]Possible overflow?
by Nicholas Berry 21 Dec '01

21 Dec '01

I too get high ASCII characters, but on a regular basis across multiple systems. I have about 20 hosts logging to two syslog-ng systems. I see this anywhere from a Foundry routers, to Solaris 8, and Lucent Maxes: ..smf-jumpstart A<A0><E1>$<30>Dec 1.. ..smf-modem-01 ^B^D^E<B4><134>ASCEND: slot 2.. ..smf-dist-01 ^B^D^E<B4><14>smf-dist-01, Interface... Thanks, Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com -----Original Message----- From: Thomas Kaehn [mailto:tk@westend.com] Sent: Friday, December 21, 2001 3:04 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Possible overflow? Hi, in some logs I discovered an ascii character with the value 181 instead of a newline: ... D4-RIPE|<181>Dec 20 19:02 ... Unfortunately I can't reproduce this error. But maybe it's a known error? It occured when logging whole mails to syslog. Does anyone know a possible cause? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Possible overflow?
by Thomas Kaehn 21 Dec '01

21 Dec '01

Hi, in some logs I discovered an ascii character with the value 181 instead of a newline: ... D4-RIPE|<181>Dec 20 19:02 ... Unfortunately I can't reproduce this error. But maybe it's a known error? It occured when logging whole mails to syslog. Does anyone know a possible cause? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

1 0

RE: [syslog-ng]mark() option?
by Todd Snyder 20 Dec '01

20 Dec '01

A bit of an operations question, but one I've never found an answer to .. what is the purpose of ---MARK---? I know it just fills up my logs, but I never really understood why I'd want that ... Suggestions? What do other people use it for? Todd. -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, December 18, 2001 12:04 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]mark() option? On Tue, Dec 04, 2001 at 08:46:00PM -0600, Bradley Hartin wrote: > > I was testing out a configuration as follows: > > options { long_hostnames(off); sync(0); mark(10); }; > source src { unix-stream("/dev/log"); internal(); }; > > destination all { file("/var/log/messages"); }; > log { source(src); destination(all); }; > > While it appears to log everything properly, I have yet (after hours) to > see a single --- MARK --- message in the logs. Is the mark option not > operational, or is there something I'm missing? sorry, mark is not implemented... -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

4 3

HUP'ing syslog-ng causes data loss
by UK 19 Dec '01

19 Dec '01

Greetings, Trying to see what happens when syslog-ng (Version 1.4.14 on Solaris 8) gets HUP'ed, as my logrotate scripts will do, while it's receiving UDP data. Using the stresstes.sh script on another host (which is using the syslog-ng box as a loghost), a stream of messages will be sent. The while loop was changed to: while [ "$i" -lt "1000" ] After the script ran, a "cat messages | wc -l" was done against the log and the results would be approx 995 lines (probably because it's UDP). Then I'd move the file and HUP syslog-ng and retested a few more times. Same results each time. Next, while stresstest.sh was running, syslog-ng would be HUP'ed two or three times. After every test the "cat messages | wc -l" would show between 965 - 975 lines. My questions: How can I prevent messages from being lost when syslog-ng gets HUP'ed? Is it due to a config file error? From reading archived logs I found this wouldn't happen with TCP but I didn't see any information about UDP. My config file: ------------ options { sync(0); create_dirs(yes); use_fqdn(yes); keep_hostname(yes); }; source src { sun-streams("/dev/log" door("/etc/.syslog_door")); udp(); internal(); }; destination d_cisco { file("/opt/logs/cisco.log"); }; destination d_other { file("/var/log/syslog-ng/$HOST/messages" sync(0) create_dirs(yes)); }; destination d_adm { file("/var/log/syslog-ng/$HOST/sysmsg" sync(0) create_dirs(yes)); }; filter f_cisco { facility(local4); }; # stuff that would go into /var/log/messages filter f_messages { level(info..warn) and not facility(auth, auth, mail, news, local4); }; filter f_daemonlog { facility(daemon) and level (info,warn,notice,err,crit,alert,emerg); }; log { source(src); filter(f_cisco); destination(d_cisco); }; log { source(src); filter(f_messages); destination(d_other); }; log { source(src); filter(f_daemonlog); destination(d_adm); }; ------------ Thanks, UK

2 3

mark() option?
by Bradley Hartin 18 Dec '01

18 Dec '01

I was testing out a configuration as follows: options { long_hostnames(off); sync(0); mark(10); }; source src { unix-stream("/dev/log"); internal(); }; destination all { file("/var/log/messages"); }; log { source(src); destination(all); }; While it appears to log everything properly, I have yet (after hours) to see a single --- MARK --- message in the logs. Is the mark option not operational, or is there something I'm missing? Thanks, -- Bradley Hartin - bhartin(a)straus-frank.com Network and Communications Administrator Straus-Frank Company

2 1

RE: [syslog-ng]Solaris8 64-bit compile
by Ohrberg, Mick 18 Dec '01

18 Dec '01

> -----Original Message----- > From: Wim-Jan Hilgenbos [mailto:wimjan@xs4all.nl] > Sent: Tuesday, December 18, 2001 8:38 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Solaris8 64-bit compile > > > On Tue, Dec 18, 2001 at 07:50:59AM -0600, Ohrberg, Mick wrote: > > Hello all. [snip] > > ld: warning: file /usr/local/lib/libfl.a(libmain.o): wrong ELF class: > > ELFCLASS64Undefined [snip] > > > > That is, I BELIEVE it's related to the libfl.a library and incompatibility > > with 64-bit mode, per above? Libol compiled without a hitch. It seems yywrap > > is missing from libfl.a. Anyone had the same problem and know how to get > > around it? > > > > Any and all help is appreciated. > > Did you rebuild the cfg-lex file from its cfg-lex.l file using flex? > If I remember correctly the one in the distributions is build > using lex. Wim-Jan, No, but what I DID do was get rid of the 64-bit flex and installed a regular 32-bit version, and then it worked fine! Sorry for the newbie-error! "God Jul och Gott Nyttt År!" /Mick

1 0

Solaris8 64-bit compile
by Ohrberg, Mick 18 Dec '01

18 Dec '01

Hello all. I'm having a bit of compilation difficulties, trying to compile syslog-ng 1.4.14 on Solaris 8, 64-bit edition. ----------[snip]---------- gcc -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -lfl -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor /usr/local/lib/libol.a -lsocket -lnsl -lxnet ld: warning: file /usr/local/lib/libfl.a(libmain.o): wrong ELF class: ELFCLASS64Undefined first referenced symbol in file yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status ----------[snip]---------- That is, I BELIEVE it's related to the libfl.a library and incompatibility with 64-bit mode, per above? Libol compiled without a hitch. It seems yywrap is missing from libfl.a. Anyone had the same problem and know how to get around it? Any and all help is appreciated. Regards, -- Mick Öhrberg Open Systems Administrator, UMB Bank na [NYSE:UMBF] Ph: (816)860-1064 Fax: (816)860-3934

2 1

RE: [syslog-ng]libol version problems
by Todd Snyder 13 Dec '01

13 Dec '01

That fixed it. What can I say, I try too hard. I figured going with the latest and greatest would be bestest. Thanks. Todd. -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Wednesday, December 12, 2001 1:56 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]libol version problems Look on http://www.balabit.hu/en/downloads/syslog-ng/downloads/ See how syslog-ng 1.4.14 is paired with libol 0.2.23 and syslog-ng 1.5.12 is paired with libol 0.3.1? Stable syslog-ng uses the 0.2.x branch and devel syslog-ng uses the 0.3.x branch of libol. On Wed, Dec 12, 2001 at 11:13:20AM -0500, Todd Snyder wrote: > Ok ... I'm really confused ... I just downloaded the most recent version of > syslog-ng, and libol (0.3.1). I got 'required version not found'. so I > went down to 2.9 - still the same thing. > > see output below: > > checking libol version >= 0.2.23... no > configure: error: Required libol version not found > [root@coupland syslog-ng-1.4.14]# libol-config --version > 0.2.9 > > > what do I do ... I need to get this up like TODAY, and I can't get it > compiled. > > I did a quick search of the archives and didn't find anything, so I > apologize if this is a common question. > > TIA > > Todd. > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 "The percentage of users running Windows NT Workstation 4.0 whose PCs stopped working more than once a month was less than half that of Windows 95 users."-- microsoft.com/ntworkstation/overview/Reliability/Highest.asp _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

libol version problems
by Todd Snyder 12 Dec '01

12 Dec '01

Ok ... I'm really confused ... I just downloaded the most recent version of syslog-ng, and libol (0.3.1). I got 'required version not found'. so I went down to 2.9 - still the same thing. see output below: checking libol version >= 0.2.23... no configure: error: Required libol version not found [root@coupland syslog-ng-1.4.14]# libol-config --version 0.2.9 what do I do ... I need to get this up like TODAY, and I can't get it compiled. I did a quick search of the archives and didn't find anything, so I apologize if this is a common question. TIA Todd.

2 1

syslog-ng and irix
by gkuchta＠astro.umn.edu 06 Dec '01

06 Dec '01

Hi, I was wondering if syslog-ng does, or at any point will, support taking logs from non syslog-ng daemons. I've poked around the documentation and the mailing list, but I didn't see this mentioned anywhere. Our department has a few old irix machines that graduate students run Fortran code on, and we'd like to forward logs from these machines to our new syslog-ng server. I played with the idea for about 30minutes earlier today, but couldn't get anything going. Is this possible? Will it be? Much thanks, Garrett -- Garrett Kuchta [gkuchta[at]astro.umn.edu] Assistant System Manager Dept. of Astronomy University of Minnesota, Twin Cities http://www.astro.umn.edu/~gkuchta

4 3

Sample Redhat configuration?
by Bradley Hartin 05 Dec '01

05 Dec '01

Can anyone provide some sample configurations for Redhat 7.1 systems, both as a central log server and it's clients? I'm about to roll out about 130 linux boxes pretty soon, all vpn clients with various other functions, and would like to maintain a central log repository. syslog-ng looks like my best bet (I'd rather have tcp than udp, just to avoid the possibility of lost logs in case of flaky lines). Unfortunately, I don't have the time for a lot of experimentation. Thanks, -- Bradley Hartin - bhartin(a)straus-frank.com Network and Communications Administrator Straus-Frank Company

3 5

secure remote logging
by Waldemar Brodkorb 03 Dec '01

03 Dec '01

Hi *, is there a possibility to do $subject? Somebody said encryption is integrated in 1.5.13, but I can't figure it out. Nothing about this in the manpage or in the html documentation. syslog-ng works quite well, but I want to secure the network communication between the instances a little bit. Is there a solution with ssh tunnel described anywhere? TIA bye Waldemar -- Are your questions smart enough? http://www.tuxedo.org/~esr/faqs/smart-questions.html

2 1

Daemons dies
by Chuck Kelly 30 Nov '01

30 Nov '01

I am running syslog-ng 1.4.14 on two different servers. One server has approx. 150 hosts logging to it. The other server has approx. 1500 hosts logging to it. The server with 1500 hosts has a problem with the daemon dying randomly, any where from 1-15 hours. I have adjusted to the log_fifo_size to 2000. Any other ideas? Since the dameon is running fine on the other server, I assume I am just running into a performance tweaking issue. -- Chuck

1 0

src/io.c patch for libol 0.2.23
by syslog-ng＠lists.thewrittenword.com 28 Nov '01

28 Nov '01

1. alloca patch below needed for HP-UX and AIX. 2. The following is not legal C89 code: struct fd_read r = { { STACK_HEADER, do_read, do_recv }, fd->fd }; You cannot assign a non-const value at initialization time. I think C99 allows this. The Sun and HP vendor compilers complain (though the Sun version allows it because they have started to incorporate C99 features). -- albert chin (china(a)thewrittenword.com) -- snip snip --- src/io.c.orig Tue Nov 27 13:04:16 2001 +++ src/io.c Tue Nov 27 13:42:26 2001 @@ -21,11 +21,28 @@ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ +#if defined _AIX && !defined __GNUC__ + #pragma alloca +#endif + #include "io.h" #include "werror.h" #include "xalloc.h" #include "format.h" +/* Make alloca work the best possible way. */ +#ifdef __GNUC__ +#define alloca __builtin_alloca +#else /* not __GNUC__ */ +#if HAVE_ALLOCA_H +#include <alloca.h> +#else /* not __GNUC__ or HAVE_ALLOCA_H */ +#ifndef _AIX /* Already did AIX, up at the top. */ +char *alloca (); +#endif /* not _AIX */ +#endif /* not HAVE_ALLOCA_H */ +#endif /* not __GNUC__ */ + #include <assert.h> #include <string.h> @@ -327,7 +344,6 @@ { debug("Read EOF on fd %i.\n", closure->fd); return A_EOF; - return 0; } if (res > 0) return res; @@ -400,7 +416,9 @@ int res; struct fd_read r = - { { STACK_HEADER, do_read, do_recv }, fd->fd }; + { { STACK_HEADER, do_read, do_recv }, 0 }; + + r.fd = fd->fd; /* The handler function may install a new handler */ res = READ_HANDLER(self->handler, @@ -482,7 +500,9 @@ int res; struct fd_write w = - { { STACK_HEADER, do_write }, fd->fd }; + { { STACK_HEADER, do_write }, 0 }; + + w.fd = fd->fd; assert(self->buffer); @@ -652,7 +672,9 @@ int blocking_read(int fd, struct read_handler *handler) { struct fd_read r = - { { STACK_HEADER, do_read }, fd }; + { { STACK_HEADER, do_read }, 0 }; + + r.fd = fd; for (;;) {

1 0

Flags?
by Jay Guerette 27 Nov '01

27 Nov '01

Is the 'flags' statement working in syslog-ng 1.4.14? It coughs on a flags(final)entry in my conf file: log { source(syslog); filter(p_ircd); destination(ircd); flags(final); }; It parses fine when the flags line is commented out... -- I hope that at this artificial inflation of a small species into the absolute measure of things one is still permitted to laugh?

2 1

syslog-ng messages sent to outside prog
by Jay Guerette 27 Nov '01

27 Nov '01

A modified code snippet that will remove the leading <nn> facility/priority indicator when shlepping log lines to an external proggie: <code> #! /bin/bash # this line enables the extended globbing in bash to make this possible shopt -s extglob while read LOGLINE do echo ${LOGLINE/+([0-9<>])} | mail wakemeup(a)noon.ok done </code> -- I hope that at this artificial inflation of a small species into the absolute measure of things one is still permitted to laugh?

1 0

RE: [syslog-ng]syslog-ng loghost project documentation
by Ben Smee 25 Nov '01

25 Nov '01

heya, on which note just wanted to say thanks for the effort of writing that up. I had a quick look at it the other day and it helped clarify a couple of things, namely how you piped things straight into swatch (which is a nice trick). regards, -------------------- Benjamin Smee Technical Specialist Optus Business Operations (NAC) "YES" OPTUS ben.smee(a)optus.net.au Tel: +61-2-93420091 Fax: +61-2-93420998 Perilous to all of us are the devices of an art deeper than we possess ourselves. -- Gandalf the White > -----Original Message----- > From: Nate Campi [mailto:nate@campin.net] > Sent: Saturday, 24 November 2001 8:01 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]syslog-ng loghost project documentation > > > I've documented just about every part of my syslog-ng setup > at work, and place it at > http://www.campin.net/newlogcheck.html. It > covers the whole > deal, from reporting with custom log scanners, swatch, > archiving to files and to a database, and more. > > This may save others time when they are starting out on their > projects. This is a work in progress, but I'm sure it could > be useful now. > -- > Nate Campi http://www.campin.net GnuPG key: > 0xC17AEF79 > Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 > > Your mantra for today is: Don't let data from the network near a > shell. Bad things happen. -- Randall Schwartz > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/sysl> og-ng >

1 0

HI
by Olav Langeland 24 Nov '01

24 Nov '01

I am logging from a Cisco Pix to syslog-ng on a FreeBSD machine. --cut-from-syslog-ng-cfg-- destination pix { file("/usr/logs/pix/log"); }; filter f_pix { host(192.168.10.1); }; log { source(src); filter(f_pix); destination(pix); }; --cut-- This logs perfectly fine, but it still logs to /var/log/messages as well. How do I filter away this? Something I have missed, scanned through couple of months of mailinglist but didnt see anything particular. Any help appreciated, syslog-ng looks really nice. -- Olav Langeland - olav.langeland(a)nosp4m.activeisp.com

2 1

syslog-ng loghost project documentation
by Nate Campi 23 Nov '01

23 Nov '01

I've documented just about every part of my syslog-ng setup at work, and place it at http://www.campin.net/newlogcheck.html. It covers the whole deal, from reporting with custom log scanners, swatch, archiving to files and to a database, and more. This may save others time when they are starting out on their projects. This is a work in progress, but I'm sure it could be useful now. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 Your mantra for today is: Don't let data from the network near a shell. Bad things happen. -- Randall Schwartz

1 0

Feature Suggestion: Additional variable $PROGRAM_ESC for filename expansion
by Norbert Nemec 23 Nov '01

23 Nov '01

Hi there, I've been using syslog-ng for quite a while and I really like that program. There is just one feature I'm missing: In my current setup, I have all the logging data sorted into files within one directory, according the the name of the program sending the message. The documentation states correctly that this is a security problem, since the $PROGRAM variable might contain just about anything, including / and . making it possible for any user to write data to about any file in the filesystem. Even on my private system, where security is not a concern, this turns out to be nasty, since a small number of programs state their whole path as program name. my idea whould be to provide an alternative variable, e.g. $PROGRAM_ESC that is internally converted to a defined set of legal characters. This does not even have to be a high-quality, reversable conversion. A plain, well defined mangling should be absolutely enough. Ciao, Nobbi PS: Please CC me, I'm not subscribed. -- -- ______________________________________________________ -- JESUS CHRIST IS LORD! -- To Him, even that machine here has to obey... -- -- _________________________________Norbert "Nobbi" Nemec -- Hindenburgstr. 44 ... D-91054 Erlangen ... Germany -- eMail: <nobbi(a)cheerful.com> Tel: +49-(0)-9131-204180

1 0