syslog-ng

Thread Start a new thread

Download

syslog-ng@lists.balabit.hu

2 participants
9276 discussions

RE: [syslog-ng]Compiling problem on Sun/Solaris
by Ari.Kuukka＠man.ac.uk 29 Aug '01

29 Aug '01

That helped, many thanks! -- Ari Kuukka -----Original Message----- From: Sander de Boer [mailto:boeraa@yahoo.com] Sent: Wednesday, August 29, 2001 11:53 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Compiling problem on Sun/Solaris I had the same problem on Solaris 8/x86. As far as I can remember I had to add libl.so to the Makefile where the libraries were specified, i.e. "-ll" Sander --- Ari.Kuukka(a)man.ac.uk wrote: > > Hello, > > I am having problems compiling syslog-ng on Solaris. > I have tried to compile several different > versions of syslog-ng (1.4.12, 1.4.13 and 1.5.9) on > both Solaris 7 and Solaris 8, using gcc version > 2.95.2. However, every time I get the same error > message below while running 'make': > > . > . > . > gcc -DHAVE_CONFIG_H -I. > -I/tmp/aek/syslog-ng-1.4.13/src -I. -O2 -Wall > -I/usr/local/include/libol > -D_GNU_SOURCE -c getopt.c > gcc -DHAVE_CONFIG_H -I. > -I/tmp/aek/syslog-ng-1.4.13/src -I. -O2 -Wall > -I/usr/local/include/libol > -D_GNU_SOURCE -c getopt1.c > gcc -O2 -Wall -I/usr/local/include/libol > -D_GNU_SOURCE -o syslog-ng main.o sources.o > center.o > filters.o destinations.o log.o cfgfile.o > cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o > afinet.o afinter.o afuser.o afstreams.o afprogram.o > utils.o syslog-names.o getopt.o getopt1.o > -lpthread -ldoor /usr/local/lib/libol.a -lsocket > -lnsl -lxnet > Undefined first referenced > symbol in file > yywrap cfg-lex.o > ld: fatal: Symbol referencing errors. No output > written to syslog-ng > collect2: ld returned 1 exit status > make[3]: *** [syslog-ng] Error 1 > make[3]: Leaving directory > `/tmp/aek/syslog-ng-1.4.13/src' > make[2]: *** [all-recursive] Error 1 > make[2]: Leaving directory > `/tmp/aek/syslog-ng-1.4.13/src' > make[1]: *** [all-recursive-am] Error 2 > make[1]: Leaving directory > `/tmp/aek/syslog-ng-1.4.13/src' > make: *** [all-recursive] Error 1 > > > Many thanks for any suggestions about what is going > wrong. > > -- > Ari Kuukka > University of Manchester > Department of Imaging Science and Biomedical > Engineering > Telephone: (+44) 0161 275 5405 > E-mail: ari.kuukka(a)man.ac.uk > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > __________________________________________________ Do You Yahoo!? Make international calls for as low as $.04/minute with Yahoo! Messenger http://phonecard.yahoo.com/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Alexander T Hay/Nationwide/NWIE is out of the office.
by HAYA＠Nationwide.com 29 Aug '01

29 Aug '01

I will be out of the office starting 08/29/2001 and will not return until 09/04/2001. I am out of the office for the remainder of this week. If you need assistance of a technical nature please contact Sean Amon at 249-5489. All other questions can be directed to Patsy Short at 677-6350.

1 0

Alexander T Hay/Nationwide/NWIE is out of the office.
by HAYA＠Nationwide.com 29 Aug '01

29 Aug '01

I will be out of the office starting 08/29/2001 and will not return until 09/04/2001. I am out of the office for the remainder of this week. If you need assistance of a technical nature please contact Sean Amon at 249-5489. All other questions can be directed to Patsy Short at 677-6350.

1 0

Alexander T Hay/Nationwide/NWIE is out of the office.
by HAYA＠Nationwide.com 29 Aug '01

29 Aug '01

I will be out of the office starting 08/29/2001 and will not return until 09/04/2001. I am out of the office for the remainder of this week. If you need assistance of a technical nature please contact Sean Amon at 249-5489. All other questions can be directed to Patsy Short at 677-6350.

1 0

Alexander T Hay/Nationwide/NWIE is out of the office.
by HAYA＠Nationwide.com 29 Aug '01

29 Aug '01

I will be out of the office starting 08/29/2001 and will not return until 09/04/2001. I am out of the office for the remainder of this week. If you need assistance of a technical nature please contact Sean Amon at 249-5489. All other questions can be directed to Patsy Short at 677-6350.

1 0

Alexander T Hay/Nationwide/NWIE is out of the office.
by HAYA＠Nationwide.com 29 Aug '01

29 Aug '01

I will be out of the office starting 08/29/2001 and will not return until 09/04/2001. I am out of the office for the remainder of this week. If you need assistance of a technical nature please contact Sean Amon at 249-5489. All other questions can be directed to Patsy Short at 677-6350.

1 0

Small fix for init.d.RedHat contrib file
by Jacques THOMAS 29 Aug '01

29 Aug '01

Hi all, The script init.d.RedHat from the contrib directory kept complaining: Starting syslog-ng: basename: too many arguments Try `basename --help' for more information. when i used it to start syslog-ng. This annoying behavior can be fixed by replacing the line: daemon "$INIT_PROG $INIT_OPTS" by daemon --check $INIT_PROG "$INIT_PROG $INIT_OPTS" I had this problem on a RedHat 7.0, and thought the solution might be helpful for others. Regards, Jacques THOMAS.

1 0

iptables & syslog-ng
by Nijs, Daniel 28 Aug '01

28 Aug '01

Hello, I just set up an iptables based firewall on my syslog-ng host machine (redhat 7.1), but ran into a small problem. When I run syslogd+klogd, I can see iptables generating the logfiles. When I disable the standard syslog daemon, and run syslog-ng+klogd, I do not see the data I am looking for, it is almost like iptables isn't logging at all, but it has to, since it works with the normal syslogd. I setup a generic rule, and a fallback, so everything should work. When using the "logger" tool, and generating a fake entry, everything seems ok, so I assume this is an issue between kernel logging and syslog-ng. I am running 1.5.9 (not the official release). Any help would be appreciated. Thanks Best regards, Daniel

2 1

RE: [syslog-ng]syslog-ng 1.5.9
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 28 Aug '01

28 Aug '01

Bazsi, Very cool. Are the stats configurable by the users? Is it some sort of option statement that that will output every X amount of minutes? Is it switchable, on and off? If these questions are all answered in the docs just simply respond "RTFM". Thanks, Drew -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, August 28, 2001 10:19 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.5.9 Hi, We have released syslog-ng 1.5.9, now officially with the following changes: * finalized log statement processing flags * updated documentation * changed syslog-ng buffering, so writing log messages is buffered (sync(10) now means that ten messages are grouped and written with a single write() syscall) * implemented fsync() option to force an fsync(fd) to logfiles after each write * implemented quick&dirty stats reporting (this is not final, now reports number of dropped messages for the last minutes) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

syslog-ng 1.5.9
by Balazs Scheidler 28 Aug '01

28 Aug '01

Hi, We have released syslog-ng 1.5.9, now officially with the following changes: * finalized log statement processing flags * updated documentation * changed syslog-ng buffering, so writing log messages is buffered (sync(10) now means that ten messages are grouped and written with a single write() syscall) * implemented fsync() option to force an fsync(fd) to logfiles after each write * implemented quick&dirty stats reporting (this is not final, now reports number of dropped messages for the last minutes) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]syslog-ng 1.5.9
by Nijs, Daniel 27 Aug '01

27 Aug '01

I have 1.5.9 running without any issues. How do I replace my DEFAULT logpath though? I am aware of the flags (I am using them), but not sure how to implement a "catch all" rule. Could you post an example please? Thanks Best regards, Dan -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Saturday, August 25, 2001 9:23 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.5.9 Hi, I managed to make some free time to hack a bit on syslog-ng. The results are available at http://www.balabit.hu/~bazsi/syslog-ng-1.5.9.tar.gz . I published this release there, because I didn't have too much time to test it now, and it changes a couple of things. I verified each new functionality at least once, and it seems to work, but it doesn't warrant anything of course. The summary of changes: * finalized the new log processing, and log statement flags (the one instead of the kludgy DEFAULT filter) This changes configuration file format from 1.5.8, which changed it from 1.5.7. This one should be final. * updated the documentation to include reference information on nearly everything (even about the new log flags). If anything is missing, please let me know. I know its English is still not the best, proofreaders welcome. I'd be grateful, if some of you could test this release. ps: the lost messages feature is not yet implemented, it's the next on the top of my todo list. ps/2: the .tar.gz is not signed. I sign this mail, so it assigns at least some trust to the file as well. (since I'm announcing it), paranoids are directed to the diffs between 1.5.8 and 1.5.9 :) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

syslog-ng 1.5.9
by Balazs Scheidler 25 Aug '01

25 Aug '01

Hi, I managed to make some free time to hack a bit on syslog-ng. The results are available at http://www.balabit.hu/~bazsi/syslog-ng-1.5.9.tar.gz . I published this release there, because I didn't have too much time to test it now, and it changes a couple of things. I verified each new functionality at least once, and it seems to work, but it doesn't warrant anything of course. The summary of changes: * finalized the new log processing, and log statement flags (the one instead of the kludgy DEFAULT filter) This changes configuration file format from 1.5.8, which changed it from 1.5.7. This one should be final. * updated the documentation to include reference information on nearly everything (even about the new log flags). If anything is missing, please let me know. I know its English is still not the best, proofreaders welcome. I'd be grateful, if some of you could test this release. ps: the lost messages feature is not yet implemented, it's the next on the top of my todo list. ps/2: the .tar.gz is not signed. I sign this mail, so it assigns at least some trust to the file as well. (since I'm announcing it), paranoids are directed to the diffs between 1.5.8 and 1.5.9 :) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

log rotation
by Joseph K Gainey 24 Aug '01

24 Aug '01

syslog-ng allows me to to complex filtering and logging, because of this I get several different log files instead of one huge monolithic syslog. Is there anyway to have syslog-ng automatically rotate the logs base on size and/or time? Joe

3 2

annoying double-hostname in logfile
by Michael Renner 24 Aug '01

24 Aug '01

hi! i replaced syslogd on our master logserver with syslog-ng, because syslogd wasn't able to handle all the incoming syslog messages (receive queue was permanent around 65500 bytes, dropped 50-90% of the incoming messages). syslog-ng now works like a charm, there's only one cosmetic flaw: every hostname in the logfile is twice, seperated by a slash, like: Aug 24 15:50:34 baby.inode.at/baby.inode.at 2961721: 13w6d: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1:13, changed state to up the sending sysloggers are syslogds, ciscos, zyxels, etc. so (at least IMHO) its not a config setting on the remote syslogger how can i prevent syslogd from double-printing the hostnames? relevant syslog-ng.conf snippet is here: --- options { sync (0); log_fifo_size (1000); use_fqdn (yes); }; --- greetz Michael Renner Inode Internet - Junior System Engineer

2 1

Re: syslog-ng config problem
by Balazs Scheidler 24 Aug '01

24 Aug '01

On Fri, Aug 24, 2001 at 02:53:43PM +0200, Jean-charles wrote: > hello, > > as said i your documentation > i tried the DEFAULT filter > but i can an error : > > [root@zeus syslog-ng]# /etc/init.d/syslog-ng start > Starting system logging: syslog-ngunresolved reference: DEFAULT > Error initializing configuration, exiting. > > > ii syslog-ng 1.5.8-2 Next generation logging daemon 1.5.x changed DEFAULT semantics, which is undocumented. A summary of the new functions were posted on the syslog-ng mailing list. Check the archives. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]Customizing the timestap format
by Andrew Fort 24 Aug '01

24 Aug '01

Hi Erwan, http://marc.theaimsgroup.com/?l=syslog-ng&m=97991394300231&w=2 describes the functionality (available in syslog-ng 1.5.x development releases) you desire. >From: Erwan Conq [mailto:erwan.conq@nextenso.com] >Subject: [syslog-ng]Customizing the timestap format > >Hello, > >I'm pretty new using Syslog-ng. I'm wondering if it's possible >to modify >the format of the time stamp reported in the logs. >Who shall I do it ?

1 0

RE: [syslog-ng]Customizing the timestap format
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 24 Aug '01

24 Aug '01

In the 1.5.x line there is a template feature that will allow you to do some customization of your log output. You'll have to look through the previous posts or the code to get syntax. I don't think the docs have been updated to give a lot of info on it yet so you may have to fool around with it. If you do get to using it post some specific questions if you have problems and someone here will help you out. Please keep in mind that 1.5.x line is an alpha line and the syntax can change at anytime without much warning. If you watch the list though Bazsi is pretty good about giving a heads up on major changes like that. Regards, Drew -----Original Message----- From: Erwan Conq [mailto:erwan.conq@nextenso.com] Sent: Friday, August 24, 2001 11:34 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Customizing the timestap format Hello, I'm pretty new using Syslog-ng. I'm wondering if it's possible to modify the format of the time stamp reported in the logs. Who shall I do it ?

1 0

Customizing the timestap format
by Erwan Conq 24 Aug '01

24 Aug '01

Hello, I'm pretty new using Syslog-ng. I'm wondering if it's possible to modify the format of the time stamp reported in the logs. Who shall I do it ?

1 0

RE: Re[2]: [syslog-ng]Full pipe as destination
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 23 Aug '01

23 Aug '01

I agree with Herr Apelt. The need for immediate notification needs to be weighed against the traffic coming out of an already overburdened service. A separate process listening for such things coming from the internal source should be sufficient to catch the necessary information. What you don't want to do is send a stream of data from the internal source when you are already dropping messages. A statistical notification every 12 or 24 hours is great but there definitely would need to be some sort of immediate notification so action can be taken to correct any problems. I think using the internal channel would allow for the least amount of development work and still give a desired result. Regards, Drew -----Original Message----- From: Volker Apelt [mailto:volker_apelt@yahoo.de] Sent: Thursday, August 23, 2001 12:57 PM To: syslog-ng(a)lists.balabit.hu Subject: Re[2]: [syslog-ng]Full pipe as destination On Thu, 23 Aug 2001 10:44:50 +0200 Andreas Schulze <andreas.schulze(a)mediaways.net> wrote: > Dear Bazsi, > Brad Arlt schrieb: > > > logs are silently dropped in this case. I was thinking of implementing some > > > kind of automatic statistics message to report log losses, but that would > > > race against normal log traffic. do you have a better idea. > > statistics are a very good idea and for many syslog-ng users its > important to know as most as possible about messages dropped > (for which destination, etc.), messages transfered by source ond/or > destination and something more. > > I think the discussions about possible log destinations hasn't the real > impact in this context. > > as you say its important that we prevent the daemon from stucks > in-active with its internal statistics stuff. > the real problem here is, to implement the output method of the stat. > informations. > but answer the following question: "is it really mandatory to realize > a continuous output of statistical informations?" > I think not. > > decide to which logging destination the stats should be send. > I think the internal() log source is a better choice than brad's "oh > shit!" file, because we keep save the flexibility of syslog-ng's rule-based flow > control. but a separate log is ok. > > but don't send the stats continuously to internal(). do this e.g. at > midnight for the last 24h. realize a command line switch to disable this feature. Sending it to the internal() queue, with serverity=alert or crit, sounds good. To me, it is important to get the notification about dropped messages immediately, because it requires some reaction. Maybe with a 'maximum notifications per minute' brake to avoid race conditions or as "minimal notification time distance" implemented as a time stamp when the last emergency message was emitted. -- Volker Apelt Group of Prof. Dr. Ch. Griesinger Dipl. Chem. Johann Wolfgang Goethe Universitat +49 6172 31126 Frankfurt am Main, Germany va .@. org.chemie.uni-frankfurt.de (remove the dots, please) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]Full pipe as destination
by Andreas Schulze 23 Aug '01

23 Aug '01

Dear Bazsi, Brad Arlt schrieb: > On Tue, Aug 21, 2001 at 02:16:09PM +0200, Balazs Scheidler wrote: > > On Tue, Aug 21, 2001 at 01:26:27PM +0200, Peter Draexler wrote: > > > Peter Draexler schrieb: > > > > > > > Dear Bazsi, > > > > thank you for your info. This should help. > > > > Nevertheless, does syslog-ng log somewhere if it discards events or do you know > > > > another way to check this? > > > > This would be important to adapt log_fifo_size. Currently we only observe by > > > > chance that we lose information. > > > > logs are silently dropped in this case. I was thinking of implementing some > > kind of automatic statistics message to report log losses, but that would > > race against normal log traffic. do you have a better idea. statistics are a very good idea and for many syslog-ng users its important to know as most as possible about messages dropped (for which destination, etc.), messages transfered by source ond/or destination and something more. I think the discussions about possible log destinations hasn't the real impact in this context. as you say its important that we prevent the daemon from stucks in-active with its internal statistics stuff. the real problem here is, to implement the output method of the stat. informations. but answer the following question: "is it really mandatory to realize a continuous output of statistical informations?" I think not. decide to which logging destination the stats should be send. I think the internal() log source is a better choice than brad's "oh shit!" file, because we keep save the flexibility of syslog-ng's rule-based flow control. but a separate log is ok. but don't send the stats continuously to internal(). do this e.g. at midnight for the last 24h. realize a command line switch to disable this feature. if 24h is to long, implement a signal handler for e.g. SIGUSR1|2 that activates the stats output. so its possible for each user to decide the time on which he likes stats by sending a SIGUSR? to the daemon. > A single message saying "log queue full" written to the syslog facilty > at emerg would due it. And rather than compete have it win the race > always. Since we are already losing messages, it is more important > that we know we are losing messages than to know what messages have > been lost (if that makes sense). > > One could also have a seperate "oh shit!" log file that only gets > written to by syslog-ng internals and not through standard mechanisms. > A non-blocking write(2) could be used to ensure that these messages > didn't impeed on other logging (much). thx. for your help best regards -- ASL

2 1

RE: [Fwd: [syslog-ng]Full pipe as destination]
by Andrew Fort 22 Aug '01

22 Aug '01

>One could also have a seperate "oh shit!" log file that only gets >written to by syslog-ng internals and not through standard mechanisms. >A non-blocking write(2) could be used to ensure that these messages >didn't impeed on other logging (much). I prefer this option also (despite its lack of elegance :), it's the most system independant and allows the sysad to stick a log watcher on it or whatever. Also because it avoids the in-band race issue.

1 0

[Fwd: [syslog-ng]Full pipe as destination]
by Peter Draexler 22 Aug '01

22 Aug '01

Peter Draexler schrieb: > Dear Bazsi, > thank you for your info. This should help. > Nevertheless, does syslog-ng log somewhere if it discards events or do you know > another way to check this? > This would be important to adapt log_fifo_size. Currently we only observe by > chance that we lose information. > Best regards Peter > > Balazs Scheidler schrieb: > > > On Tue, Aug 14, 2001 at 08:45:35AM +0200, Peter Draexler wrote: > > > Hi, > > > > > > We are using syslog-ng on our logserver with multifunctional > > > logforwarding. > > > As a special type of destination we are using pipes as a special > > > interface to commercial applications. > > > > > > Here is our question: > > > What happens with the log events, if the pipe becomes > > > temp. unavailable (e.g. the reading end is dead or > > > the pipe is full)? > > > > > > IMHO you have to open() the pipe nonblocking, to avoid your > > > syslog stucks in-active, in the case one destination is broken. > > > I think this is true. Correct? > > > > it's true. > > > > > > > > What happens with your internal log buffers, if write() returns -1 > > > and errno set to EAGAIN? > > > You implement an internal buffering/queue and try to write the > > > outstanding log events some times later or you simply discard > > > the buffers as long as one destination is unreachable? > > > > messages are queued up to the value of log_fifo_size, which IIRC can be set > > on a per-destination basis. if the fifo is full, messages are discarded. > > > > > > > > A Hint for syslog-ng.1.5.8 on Solaris 8: > > > $DATE in destination templates returns nothing. > > > But $FULL|ISODATE works fine. > > > > this seems to be fixed in my CVS tree, though it's not yet released. > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > -- > Dr. Peter Dräxler > mediaWays GmbH > Hülshorstweg 30 > 33415 Verl > Tel. +49-5246-80-1888 > Fax +49-5246-80-2888 > peter.draexler(a)mediaways.net > ------------------------------ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2

RE: [syslog-ng]hostname on loghost
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 20 Aug '01

20 Aug '01

Nate, In the options part using use_fqdn(yes) will give you the fully qualified domain name. There are other ways to do this as well. Since 1 comes in tcp and the other udp you could set up separate sources and base your destinations on the sources, or something similar. I would use the use_fqdn option since I have the same problem as you except I have 7 ns1's. regards, Drew -----Original Message----- From: Nate Campi [mailto:nate@campi.cc] Sent: Friday, August 17, 2001 10:17 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]hostname on loghost I have about a hundred machines logging to a central syslog-ng loghost, most over standard UDP, a handful relayed from a syslog-ng loghost (over TCP) in a datacenter to the central loghost. The problem I'm having is this: we have two hosts named ns1 (who could imagine that?). The first logs over UDP (solaris 8) to the central loghost. I decided to put the second (hostname is configured as ns1.sjc, running - solaris 2.6) logging from syslog-ng over TCP to the loghost. I've always had good luck with the syslog-ng TCP connections keeping the hostname as sent from the TCP client syslog-ng. This time, though, the messages both on the TCP client and central syslog-ng server report the host as ns1. I want it to be ns1.sjc, and the two hosts will log differently, and archive differently. I archive with lines like this: file("/var/log/HOSTS/$HOST/$FACILITY/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$ DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(src); destination(hosts); }; So it's critical that I get a different hostname for the two hosts. Can I somehow set the hostname for syslog-ng to log as? `hostname` reports ns1.sjc on the host, so why can't I use that? I've mucked around with options like keep_hostname and long_hostnames but they just seem to stick the "source" name on the messages, not what I need. Any ideas? -- Nate _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

hostname on loghost
by Nate Campi 17 Aug '01

17 Aug '01

I have about a hundred machines logging to a central syslog-ng loghost, most over standard UDP, a handful relayed from a syslog-ng loghost (over TCP) in a datacenter to the central loghost. The problem I'm having is this: we have two hosts named ns1 (who could imagine that?). The first logs over UDP (solaris 8) to the central loghost. I decided to put the second (hostname is configured as ns1.sjc, running - solaris 2.6) logging from syslog-ng over TCP to the loghost. I've always had good luck with the syslog-ng TCP connections keeping the hostname as sent from the TCP client syslog-ng. This time, though, the messages both on the TCP client and central syslog-ng server report the host as ns1. I want it to be ns1.sjc, and the two hosts will log differently, and archive differently. I archive with lines like this: file("/var/log/HOSTS/$HOST/$FACILITY/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(src); destination(hosts); }; So it's critical that I get a different hostname for the two hosts. Can I somehow set the hostname for syslog-ng to log as? `hostname` reports ns1.sjc on the host, so why can't I use that? I've mucked around with options like keep_hostname and long_hostnames but they just seem to stick the "source" name on the messages, not what I need. Any ideas? -- Nate

1 0

Full pipe as destination
by Peter Draexler 16 Aug '01

16 Aug '01

Hi, We are using syslog-ng on our logserver with multifunctional logforwarding. As a special type of destination we are using pipes as a special interface to commercial applications. Here is our question: What happens with the log events, if the pipe becomes temp. unavailable (e.g. the reading end is dead or the pipe is full)? IMHO you have to open() the pipe nonblocking, to avoid your syslog stucks in-active, in the case one destination is broken. I think this is true. Correct? What happens with your internal log buffers, if write() returns -1 and errno set to EAGAIN? You implement an internal buffering/queue and try to write the outstanding log events some times later or you simply discard the buffers as long as one destination is unreachable? Thanks very much. Best Regards -- Andreas and Peter A Hint for syslog-ng.1.5.8 on Solaris 8: $DATE in destination templates returns nothing. But $FULL|ISODATE works fine. -- Dr. Peter Dräxler mediaWays GmbH Hülshorstweg 30 33415 Verl Tel. +49-5246-80-1888 Fax +49-5246-80-2888 peter.draexler(a)mediaways.net ------------------------------

2 2

RE: [syslog-ng]compiling on Solaris 8
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 16 Aug '01

16 Aug '01

--- Balazs Scheidler <bazsi(a)balabit.hu> wrote: > try this patch: > > diff -u -r1.10.2.1 afstreams.c > --- afstreams.c 2001/02/25 12:30:22 1.10.2.1 > +++ afstreams.c 2001/07/16 08:26:55 > @@ -164,7 +164,7 @@ > { > NEW(stream_fd, f); > > - init_file(backend, &f->super, fd); > + init_file(backend, &f->super, fd, NULL); > f->super.prepare = prepare_stream_fd; > f->super.read = stream_read_callback; > f->super.want_read = 1; Believe this is fixed in 1.4.13, but I don't think Bazsi has had time to officially release that on the website. You can make the slight mod to the afstreams.c file and it will work. Regards, Drew -----Original Message----- From: David Monk [mailto:david@purplebear.net] Sent: Wednesday, August 15, 2001 11:41 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]compiling on Solaris 8 I have tried several times to get syslog-ng to compile on Solaris 8 with GNU tools. I have tried the most current release of the 1.4 branch and 1.2 branch, with no luck. Each one complains about a different function with too few arguments. In the 1.4 release, it was src/afstreams.c line 167, init_file function, I believe. Has anyone successfully done this? Seeing that the site says it's in wide use on Solaris, I am hoping so. Please someone tell me what I am missing.I really need a syslog facility with remote reception capabilities. Thank you, David Monk CCNA, MCSE david(a)purplebear.net _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

compiling on Solaris 8
by David Monk 15 Aug '01

15 Aug '01

I have tried several times to get syslog-ng to compile on Solaris 8 with GNU tools. I have tried the most current release of the 1.4 branch and 1.2 branch, with no luck. Each one complains about a different function with too few arguments. In the 1.4 release, it was src/afstreams.c line 167, init_file function, I believe. Has anyone successfully done this? Seeing that the site says it's in wide use on Solaris, I am hoping so. Please someone tell me what I am missing.I really need a syslog facility with remote reception capabilities. Thank you, David Monk CCNA, MCSE david(a)purplebear.net

1 0

Re: syslogd-ng
by Balazs Scheidler 15 Aug '01

15 Aug '01

On Tue, Aug 14, 2001 at 02:45:56PM -0400, Erik Ivanenko wrote: > The latest "stable" versions do not compile on Solaris 2.6. > > Failure during compilation: > > afstreams.c:167: too few arguments to function 'init_file' http://www.balabit.hu/downloads/syslog-ng/1.4/syslog-ng-1.4.13.tar.gz I'll announce it as soon as I'll have some time. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]NT Eventlog -> UNIX Syslog
by Nijs, Daniel 12 Aug '01

12 Aug '01

Free lunch!!!! ;) Thanks for that link, I am downloading it right now. Wonder why this never showed up in search engines. Best regards, Dan -----Original Message----- From: Michael Hargadon [mailto:MHargadon@ITDepartment.com] Sent: Tuesday, August 07, 2001 10:00 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]NT Eventlog -> UNIX Syslog Since there was a lot of interest in this I figured I'd be nice and provide a link to the software I use. ;) http://www.intersectalliance.com/projects/index.html#BackLog It's free, too.. Regards, Michael Hargadon mhargadon(a)itdepartment.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

3 3

timestamp issues
by Mickey Everts 12 Aug '01

12 Aug '01

How is it possible to have out of order time stamps? My first thought would be that somehow the device itself is sending the timestamp. Do devices have the option of sending a timestamp or not? I would prefer that the syslog daemon itself always write the timestamp if possible to avoid confusion when trying to diagnose multiple device events. Aug 2 15:11:24 ap01.yipes.com KERN: NV:Completed configuration save (secondary) operation Aug 2 15:10:47 t3-0-2-0.jp02.yipes.com mgd[13087]: UI_JUNOSCRIPT_ERROR: junoscript error: syntax error, expecting <command> Aug 2 15:11:26 t3-0-2-0.jp02.yipes.com mgd[13087]: UI_CMDLINE_READ_LINE: user 'auser', command 'start shell ' -MiC Mickey Everts 415.901.2223 direct Unix System Administrator 415.901.2000 main Yipes Communications, Inc. 415.533.1402 cell http://www.yipes.com/ 415.358.4112 fax

3 3

Loganalysis mailing list
by Tina Bird 09 Aug '01

09 Aug '01

The Log Analysis mailing list is a forum for system administrators who are building and using a centralized logging infrastructure in their networks. Most of the discussion will focus on the care and feeding of syslog -- central loghosts, how to configure the devices in your network, how to secure your log infrastructure. We also talk about how to manage and process your log data. One of my primary goals for this list is to collect log data from attacks "in the wild," and to build configuration files for swatch and logsurfer that contain samples of these known attack signatures. Hopefully this will encourage more people to look at their logfiles regularly. I will also be publishing syslog configurations for devices as I collect them. This list is moderated by Tina Bird. To subscribe to the LogAnalysis mailing list, send an empty e-mail message to loganalysis-subscribe(a)securityfocus.com from the account you want to add. You'll be asked to confirm the subscription request, and sent a list of administrative commands for your subscription. And start talking! Thanks -- tbird

1 0

RE: [syslog-ng]syslog-ng tcp ports
by nothingsTrivial - 09 Aug '01

09 Aug '01

Hi Ravi, I think all you need to change is the source statements listen address. Try, something like this; source s_net_tcp { tcp(ip(0.0.0.0) port(4474)); }; Hope that helps. Shawn -----Original Message----- From: Ravi Malghan [mailto:rmalghan@yahoo.com] Sent: Thursday, August 09, 2001 5:19 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng tcp ports Hello: I have a environment where the syslog clients are out side the firewall and the server is inside. The clients are configured to connect to port 4474 using TCP. I enabled this port on the firewall but still the connections donot go through. Are there any pther ports I need to enable on the firewall? Server side: source syslog-ng-client_tcp {tcp(ip(192.168.17.90) port(4474));}; Client side destination syslog-ng-server1 { tcp("192.168.17.90" port(4474)); }; TIA Ravi _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

1 0

syslog-ng tcp ports
by Ravi Malghan 09 Aug '01

09 Aug '01

Hello: I have a environment where the syslog clients are out side the firewall and the server is inside. The clients are configured to connect to port 4474 using TCP. I enabled this port on the firewall but still the connections donot go through. Are there any pther ports I need to enable on the firewall? Server side: source syslog-ng-client_tcp {tcp(ip(192.168.17.90) port(4474));}; Client side destination syslog-ng-server1 { tcp("192.168.17.90" port(4474)); }; TIA Ravi

1 0

Re: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

6 6

RE: Can someone please stop this: RE: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie)
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 08 Aug '01

08 Aug '01

Bazsi blocked him you can take the rule out. -----Original Message----- From: Robert Andersson [mailto:robert@ling.gu.se] Sent: Wednesday, August 08, 2001 11:12 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: Can someone please stop this: RE: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie) jon, >>>>> "JN" == Jon Nistor <nistor(a)snickers.org> writes: JN> .procmailrc -> JN> :0 JN> * ^(To|From|cc).*Erick.Staal(a)onl.pinkroccade.nl JN> /dev/null thanx, now his emails will be lost in cyber space... errr... thus does also probably mean that i will be annoyed by him forever cause i can never read his eamil where he appologises for this... :) /robert _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

1 0

Re: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

1 0

Re: Can someone please stop this: RE: [syslog-ng]smallsyslog-ng1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

1 0

small syslog-ng 1.5.8 bug
by Jay Soffian 08 Aug '01

08 Aug '01

I haven't tracked this down yet, but it appears that when you send syslog-ng a SIGHUP while it is running with '-v', it terminates instead of restarting. # uname -a Linux syslog01 2.2.16-3smp #1 SMP Mon Jun 19 19:00:35 EDT 2000 i686 unknown # syslog-ng -V syslog-ng 1.5.8 j.

2 1

RE: Can someone please stop this: RE:[syslog-ng]smallsyslog-ng1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

1 0

RE: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

1 0

RE: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

1 0

RE: Can someone please stop this: RE: [syslog-ng]small syslog-ng1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

1 0

RE: Can someone please stop this: RE: [syslog-ng]smallsyslog-ng1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

1 0

Re: Can someone please stop this:RE:[syslog-ng]smallsyslog-ng1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

1 0

Re: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

1 0

RE: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie)
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 08 Aug '01

08 Aug '01

Can we get this person blocked? -----Original Message----- From: Erick Staal [mailto:Erick.Staal@onl.pinkroccade.nl] Sent: Wednesday, August 08, 2001 7:26 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie) Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

RE: Can someone please stop this: RE: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie)
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 08 Aug '01

08 Aug '01

Works great from unix. Unfortunately not on windoze. -----Original Message----- From: Jon Nistor [mailto:nistor@snickers.org] Sent: Wednesday, August 08, 2001 9:55 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: Can someone please stop this: RE: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie) .procmailrc -> :0 * ^(To|From|cc).*Erick.Staal(a)onl.pinkroccade.nl /dev/null my solution =) On Wed, 8 Aug 2001, Torsten Curdt wrote: ::: ::: :::> -----Original Message----- :::> From: syslog-ng-admin(a)lists.balabit.hu :::> [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Erick Staal :::> Sent: Wednesday, August 08, 2001 8:49 AM :::> To: syslog-ng(a)lists.balabit.hu :::> Subject: Re: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie) :::> :::> :::> Hallo, :::> :::> Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: :::> :::> Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische :::> zaken of Maarten Hartsuijker voor technische zaken. :::> :::> Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. :::> :::> Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. :::> :::> mvg, Erick Staal :::> :::> _______________________________________________ :::> syslog-ng maillist - syslog-ng(a)lists.balabit.hu :::> https://lists.balabit.hu/mailman/listinfo/syslog-ng :::> ::: :::_______________________________________________ :::syslog-ng maillist - syslog-ng(a)lists.balabit.hu :::https://lists.balabit.hu/mailman/listinfo/syslog-ng ::: _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: Can someone please stop this: RE: [syslog-ng]small syslog-ng1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

1 0

RE: [syslog-ng]small syslog-ng 1.5.8 bug (Vakantie)
by Erick Staal 08 Aug '01

08 Aug '01

Hallo, Omdat ik tot 27 augustus vakantie vier wil ik graag uw aandacht vragen voor het volgende: Betreft uw mail of afspraak het project RYX: neemt u dan alstublieft contact op met Paul ter Beek voor organisatorische zaken of Maarten Hartsuijker voor technische zaken. Betreft uw mail of afspraak het project Vibase neemt u dan alstublieft contact op met Otte Jaarsma. Voor overige zaken neem ik na mijn vakantie indien gewenst weer contact met u op. mvg, Erick Staal

1 0

Jump to page: