- syslog-ng - lists.balabit.hu

How to log messages generated by C program and log file rotation
by Jean Faye 07 Aug '14

07 Aug '14

confirm a6d843f7ad7d1dbf1fefb6f12432e54941a680a9 Hi all, I want to use syslog-ng to log the messages generated by my application implemented in C language. I added this in the code: char *log="rtcd"; printf("[%s] RTC adjustement\n",__func__); openlog(log, LOG_PID, LOG_LOCAL0); syslog(LOG_DEBUG, "[FIJ] RTC adjustement"); closelog(); For me, according to the syslog-ng file, the files /var/log/ldb/GENTrace.log, /var/log/ldb/SUTrace.log, /var/log/ldb/WANTrace.log and /var/log/ldb/CPLTrace.log must be created and must contain the syslog message. But I got no messages in my destination files. You can see the content of my syslog-ng.conf file bellow. Is it the right way to log the messages sent by C program? What can explain that I got no messages in the destinations files? Concerning log file rotation, How can we manage it using syslog-ng? For example I want to have a destination file with a size maximum = 2Mo and if the size is greater than the max size, I have to save the current one and create a new one. On my system I can have max 4 files (4 x 2Mo). How can I manage this kind of rotation? Thanks in advance. Best regards, Ismael Jean FAYE @version: 3.5 # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. Originally written by anonymous (I can't find his name) # Revised, and rewrited by me (SZALAY Attila <sasa(a)debian.org>) # First, set some global options. options { chain_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no); owner("root"); group("adm"); perm(0640); stats_freq(0); bad_hostname("^gconfd$");create_dirs(yes); }; ######################## # Sources ######################## source s_mysource { pipe("/tmp/pipe" pad_size(2048)); }; ######################## # Destinations ######################## destination d_GEN { file("/var/log/ldb/GENTrace.log"); }; destination d_SU { file("/var/log/ldb/SUTrace.log"); }; destination d_WAN { file("/var/log/ldb/WANTrace.log"); }; destination d_CPL { file("/var/log/ldb/CPLTrace.log"); }; ######################## # Filters ######################## #filter f_GEN { #facility(local0) and filter(nom_du_composant_applicatif); #facility(local0) and filter(f_debug); #facility(local0); #}; filter f_SU { #facility(local0) and filter(nom_du_composant_applicatif); #facility(local0) and filter(f_debug); facility(local0); }; filter f_WAN { #facility(local0) and filter(nom_du_composant_applicatif); #facility(local0) and filter(f_debug); facility(local0); }; filter f_CPL { #facility(local0) and filter(nom_du_composant_applicatif); #facility(local0) and filter(f_debug); facility(local0); }; ######################## # Log paths ######################## #log { source(s_mysource); filter(f_GEN); destination(d_GEN); }; log { source(s_mysource); filter(f_SU); destination(d_SU); }; log { source(s_mysource); filter(f_WAN); destination(d_WAN); }; log { source(s_mysource); filter(f_CPL); destination(d_CPL); };

3 5

Re: [syslog-ng] FW: Syslog Problem
by Jim Hendrick 06 Aug '14

06 Aug '14

I agree with Evan. You need to know which events are actually being received. The simplified configuration I sent should provide that and the you can add back the filters and database destination. Jim Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: Evan Rempel <erempel(a)uvic.ca> Date:08/06/2014 11:22 AM (GMT-05:00) To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] FW: Syslog Problem > Could you please tell me how to check under load mysql silently drop records There is no record that this occurs. You need to have an authoritative source of what should be in the database, and then look to see what is actually in the database. > And could you please tell me what is the solution for this problem? To be honest, I wasn't very interested in the solution. The database should not have don that to begin with. Depending on load and version of mysql the problem would go away, or return. I never found a solution because I didn't look to hard for one. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

FW: Syslog Problem
by Riyas Ahamed 06 Aug '14

06 Aug '14

Hi, I have configured a syslog-ng server to capture network logs. I can able to fetch network logs of three devices. But in fourth network device I can able to see packets are get polling into the syslog server in port 514 by using tcpdump command but I cannot find the network device in syslogng front end. Syslog OS : CentOS release 6.5 (Final) Syslog Version : syslog-ng 3.2.5 Along with this mail I have attached configuration file of syslogng server. Please help me to resolve this issue. Regards, N.B.RIAZ AHMED (9047166496) https://www.csscorp.com/email-disclaimer

4 8

syslog-ng 3.5.6 has been released
by devel＠balabit.hu 05 Aug '14

05 Aug '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.5.6 SUMMARY : new stable release DATE : Aug 5, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.5.6) has been released. For latest fixes in the 3.5.x feature branch you are recommended to upgrade to this version. CHANGES: 3.5.6 Mon, 4 Aug 2014 13:39:42 +0200 This is the sixth bug-fix release for the 3.5.x series. Upgrading from earlier versions is highly recommended, as the changes in this release are very small, yet, also very important for most platforms and workloads. Bugfixes ======== * A major memory leak was fixed in the value-pairs framework, which affects $(format-json), MongoDB, AMQP and more. The leak was supposed to be fixed in 3.5.5, but due to a merging mistake, it was missed. * The configure script now detects Linux capabilities properly, there is no need to use --disable-linux-caps on non-Linux platforms anymore. * The pdbtool merge command will now generate version 4 patterndb files, instead of version 3. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessary to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Fabien Wernli Gergely Nagy Peter Czanik DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.5.6 The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

Syslog Problem
by Riyas Ahamed 05 Aug '14

05 Aug '14

Hi, I have configured a syslog-ng server to capture network logs. I can able to fetch network logs of three devices. But in fourth network device I can able to see packets are get polling into the syslog server in port 514 by using tcpdump command but I cannot find the network device in syslogng front end. Syslog OS : CentOS release 6.5 (Final) Syslog Version : syslog-ng 3.2.5 Along with this mail I have attached configuration file of syslogng server. Please help me to resolve this issue. Regards, N.B.RIAZ AHMED (9047166496) https://www.csscorp.com/email-disclaimer

1 0

Plugin module not found and Error parsing source, source plugin pipe not found
by Jean Faye 01 Aug '14

01 Aug '14

confirm a6d843f7ad7d1dbf1fefb6f12432e54941a680a9 Hi all, When I run syslog-ng on my platform I faced the issue below. Could you please tell me why this issues happen and how can I fixed them? I am using syslog-ng-3.2.5 and eventlog-0.2.13. See in below the syslog-ng.conf I used. Thank you in advance Ismael /**************Error Logs*******************/ Starting syslog-ng:Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='syslogformat' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='basicfuncs' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='afsocket' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='affile' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='afprog' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='afuser' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='dbparser' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='csvparser' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='syslogformat' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='basicfuncs' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='afsocket' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='affile' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='afprog' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='afuser' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='dbparser' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='csvparser' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='confgen' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='confgen' Error parsing source, source plugin pipe not found in /etc/syslog-ng.conf at line 26, column 2: pipe("/tmp/pipe" pad_size(2048)); ^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng confirm a6d843f7ad7d1dbf1fefb6f12432e54941a680a9 syslog-ng.conf @version: 3.2 @include "scl.conf" # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. Originally written by anonymous (I can't find his name) # Revised, and rewrited by me (SZALAY Attila <sasa(a)debian.org>) # First, set some global options. options { long_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no); owner("root"); group("adm"); perm(0640); stats_freq(0); bad_hostname("^gconfd$");create_dirs(yes); }; ######################## # Sources ######################## # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source s_src { unix-dgram("/dev/log"); internal(); # file("/proc/kmsg" program_override("kernel")); #}; ######FIJ###### source s_mysource { pipe("/tmp/pipe" pad_size(2048)); #file("/var/log/ldb/fij_source.log" create_dirs(yes)); }; ############### # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # #source s_net { tcp(ip(127.0.0.1) port(1000) authentication(required) encrypt(allow)); }; ######################## # Destinations ######################## # First some standard logfile # #destination d_auth { file("/var/log/auth.log"); }; #destination d_cron { file("/var/log/cron.log"); }; #destination d_daemon { file("/var/log/daemon.log"); }; #destination d_kern { file("/var/log/kern.log"); }; #destination d_lpr { file("/var/log/lpr.log"); }; #destination d_mail { file("/var/log/mail.log"); }; #destination d_syslog { file("/var/log/syslog"); }; #destination d_user { file("/var/log/user.log"); }; #destination d_uucp { file("/var/log/uucp.log"); }; # This files are the log come from the mail subsystem. # #destination d_mailinfo { file("/var/log/mail/mail.info"); }; #destination d_mailwarn { file("/var/log/mail/mail.warn"); }; #destination d_mailerr { file("/var/log/mail/mail.err"); }; # Logging for INN news system # #destination d_newscrit { file("/var/log/news/news.crit"); }; #destination d_newserr { file("/var/log/news/news.err"); }; #destination d_newsnotice { file("/var/log/news/news.notice"); }; # Some `catch-all' logfiles. # #destination d_debug { file("/var/log/debug"); }; #destination d_error { file("/var/log/error"); }; #destination d_messages { file("/var/log/messages"); }; # The root's console. # #destination d_console { usertty("root"); }; # Virtual console. # #destination d_console_all { file("/dev/tty10"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination d_xconsole { pipe("/dev/xconsole"); }; # Send the messages to an other host # #destination d_net { tcp("127.0.0.1" port(1000) authentication(on) encrypt(on) log_fifo_size(1000)); }; # Debian only #destination d_ppp { file("/var/log/ppp.log"); }; ######FIJ###### ########################Vérifier l'option create_dirs(yes)###################### destination d_GEN { #file("/var/log/ldb/GENTrace.log" create_dirs(yes)); file("/var/log/ldb/GENTrace.log"); }; destination d_SU { #file("/var/log/ldb/SUTrace.log" create_dirs(yes)); file("/var/log/ldb/SUTrace.log"); }; destination d_WAN { #file("/var/log/ldb/WANTrace.log" create_dirs(yes)); file("/var/log/ldb/WANTrace.log"); }; destination d_CPL { #file("/var/log/ldb/CPLTrace.log" create_dirs(yes)); file("/var/log/ldb/CPLTrace.log"); }; ############### ######################## # Filters ######################## # Here's come the filter options. With this rules, we can set which # message go where. #filter f_dbg { level(debug); }; #filter f_info { level(info); }; #filter f_notice { level(notice); }; #filter f_warn { level(warn); }; #filter f_err { level(err); }; #filter f_crit { level(crit .. emerg); }; #filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; #filter f_error { level(err .. emerg) ; }; #filter f_messages { level(info,notice,warn) and # not facility(auth,authpriv,cron,daemon,mail,news); }; #filter f_auth { facility(auth, authpriv) and not filter(f_debug); }; #filter f_cron { facility(cron) and not filter(f_debug); }; #filter f_daemon { facility(daemon) and not filter(f_debug); }; #filter f_kern { facility(kern) and not filter(f_debug); }; #filter f_lpr { facility(lpr) and not filter(f_debug); }; #filter f_local { facility(local0, local1, local3, local4, local5, # local6, local7) and not filter(f_debug); }; #filter f_mail { facility(mail) and not filter(f_debug); }; #filter f_news { facility(news) and not filter(f_debug); }; #filter f_syslog3 { not facility(auth, authpriv, mail) and not filter(f_debug); }; #filter f_user { facility(user) and not filter(f_debug); }; #filter f_uucp { facility(uucp) and not filter(f_debug); }; #filter f_cnews { level(notice, err, crit) and facility(news); }; #filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; #filter f_ppp { facility(local2) and not filter(f_debug); }; #filter f_console { level(warn .. emerg); }; ######FIJ###### filter f_GEN { facility(local0) and filter(nom_du_composant_applicatif); }; filter f_SU { facility(local0) and filter(nom_du_composant_applicatif); }; filter f_WAN { facility(local0) and filter(nom_du_composant_applicatif); }; filter f_CPL { facility(local0) and filter(nom_du_composant_applicatif); }; ############### ######################## # Log paths ######################## #log { source(s_src); filter(f_auth); destination(d_auth); }; #log { source(s_src); filter(f_cron); destination(d_cron); }; #log { source(s_src); filter(f_daemon); destination(d_daemon); }; #log { source(s_src); filter(f_kern); destination(d_kern); }; #log { source(s_src); filter(f_lpr); destination(d_lpr); }; #log { source(s_src); filter(f_syslog3); destination(d_syslog); }; #log { source(s_src); filter(f_user); destination(d_user); }; #log { source(s_src); filter(f_uucp); destination(d_uucp); }; #log { source(s_src); filter(f_mail); destination(d_mail); }; #log { source(s_src); filter(f_mail); filter(f_info); destination(d_mailinfo); }; #log { source(s_src); filter(f_mail); filter(f_warn); destination(d_mailwarn); }; #log { source(s_src); filter(f_mail); filter(f_err); destination(d_mailerr); }; #log { source(s_src); filter(f_news); filter(f_crit); destination(d_newscrit); }; #log { source(s_src); filter(f_news); filter(f_err); destination(d_newserr); }; #log { source(s_src); filter(f_news); filter(f_notice); destination(d_newsnotice); }; #log { source(s_src); filter(f_cnews); destination(d_console_all); }; #log { source(s_src); filter(f_cother); destination(d_console_all); }; #log { source(s_src); filter(f_ppp); destination(d_ppp); }; #log { source(s_src); filter(f_debug); destination(d_debug); }; #log { source(s_src); filter(f_error); destination(d_error); }; #log { source(s_src); filter(f_messages); destination(d_messages); }; #log { source(s_src); filter(f_console); destination(d_console_all); destination(d_xconsole); }; #log { source(s_src); filter(f_crit); destination(d_console); }; # All messages send to a remote site # #log { source(s_src); destination(d_net); }; ######FIJ###### log { source(s_mysource); filter(f_GEN); destination(d_GEN); }; log { source(s_mysource); filter(f_SU); destination(d_SU); }; log { source(s_mysource); filter(f_WAN); destination(d_WAN); }; log { source(s_mysource); filter(f_CPL); destination(d_CPL); }; ###############

4 8

syslog-ng with mongodb support in EPEL7
by Peter Czanik 01 Aug '14

01 Aug '14

Hi, syslog-ng with mongodb support was successfully built for EPEL7. It should be on the mirrors by the weekend. If you are really inpatient, you can download libmongo-client and the new build directly from the build system: libmongo-client: http://koji.fedoraproject.org/koji/buildinfo?buildID=549386 syslog-ng: http://koji.fedoraproject.org/koji/buildinfo?buildID=549647 Have a nice weekend! Bye -- Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

syslog-ng-3.5.5 bison: invalid argument `no-yacc' for `--warnings'
by Scot Needy 31 Jul '14

31 Jul '14

Sorry if this is a dupe. Looked through my mail archives and didn’t see any hits. Trying to compile syslog-ng on CentOS 6.5 final and make fails on bison arguments. [root(a)syslog-ng-3.5.5]# make YACC lib/rewrite/rewrite-expr-grammar.c bison: invalid argument `no-yacc' for `--warnings' Valid arguments are: - `none - no warnings' - `midrule-values - unset or unused midrule values' - `yacc - incompatibilities with POSIX YACC' - `all - all of the above' - `error - warnings are errors' YACC lib/rewrite/rewrite-expr-grammar.h …. ….. …. bison: invalid argument `no-yacc' for `--warnings' Valid arguments are: - `none - no warnings' - `midrule-values - unset or unused midrule values' - `yacc - incompatibilities with POSIX YACC' - `all - all of the above' - `error - warnings are errors' make --no-print-directory all-recursive CC lib/lib_libsyslog_ng_la-afinter.lo CC lib/lib_libsyslog_ng_la-apphook.lo YACC lib/block-ref-grammar.h bison: invalid argument `no-yacc' for `--warnings' Valid arguments are: - `none - no warnings' - `midrule-values - unset or unused midrule values' - `yacc - incompatibilities with POSIX YACC' - `all - all of the above' - `error - warnings are errors' CC lib/lib_libsyslog_ng_la-block-ref-parser.lo lib/block-ref-parser.c:26:31: error: block-ref-grammar.h: No such file or directory lib/block-ref-parser.c:43: error: 'LL_CONTEXT_BLOCK_REF' undeclared here (not in a function) make[2]: *** [lib/lib_libsyslog_ng_la-block-ref-parser.lo] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 ============== ./configure output =================== configure: creating ./config.status config.status: creating librabbitmq.pc config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged config.status: executing depfiles commands config.status: executing libtool commands rabbitmq-c build options: Host: x86_64-unknown-linux-gnu Version: 0.2.0 64-bit: no Tools: no Documentation: no syslog-ng Open Source Edition 3.5.5 configured Compiler options: compiler : gcc -std=gnu99 compiler options : -g -O2 -Wall -pthread -pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/local/include/eventlog -I$(top_srcdir)/lib/ivykis/src/include -I$(top_builddir)/lib/ivykis/src/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : prefix : /usr/local linking mode : dynamic embedded crypto : no __thread keyword : yes Submodules: ivykis : internal libmongo-client : internal librabbitmq : internal Features: Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : no Linux capability support : no PCRE support : no Env wrapper support : no systemd support : no (unit dir: none) Modules: Module search path : /usr/local/lib/syslog-ng Sun STREAMS support (module): no SSL support (module) : yes SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : yes SMTP support (module) : yes AMQP destination (module) : yes STOMP destination (module) : yes GEOIP support (module) : no Redis support (module) : no

3 4

Problem with mongodb
by DeeKaeOne 31 Jul '14

31 Jul '14

Hi, I have a fresh CentOS 7 minimal installation and enabled the EPEL 7 repo. Then installed syslog-ng and syslog-dbi in the following versions: Installed Packages Name : syslog-ng Arch : x86_64 Version : 3.5.5 Release : 1.el7 Size : 1.6 M Repo : installed >From repo : epel Summary : Next-generation syslog server URL : http://www.balabit.com/network-security/syslog-ng Installed Packages Name : syslog-ng-libdbi Arch : x86_64 Version : 3.5.5 Release : 1.el7 Size : 61 k Repo : installed >From repo : epel Summary : libdbi support for syslog-ng URL : http://www.balabit.com/network-security/syslog-ng All documentations say that this version should support mongodb, but after some debugging I found this output while failing to start syslog-ng: Adding include file; filename='/etc/syslog-ng/conf.d/mongodb.conf' Starting to read include file; filename='/etc/syslog-ng/conf.d/mongodb.conf', depth='1' Error parsing destination, destination plugin mongodb not found in /etc/syslog-ng/conf.d/mongodb.conf at line 2, column 5: included from /etc/syslog-ng/syslog-ng.conf line 68, column 1 mongodb( ^^^^^^^ Where my /etc/syslog-ng/conf.d/mongodb.conf looks like this: destination d_mongodb { mongodb(); }; log { source(s_sys); destination(d_mongodb); }; Am I missing something or is that rpm compiled without mongodb support? Glad about any ideas! Cheers, Dennis --

2 3

Can you have multiple non-standard TCP ports as sources
by Smith, Jerry Don II 30 Jul '14

30 Jul '14

Good Afternoon, I am trying to setup a syslog-ng aggregation server and I can currently get it to listen on standard 601/514 ports. source remote { udp(ip(0.0.0.0)); tcp(ip(0.0.0.0) port(601) max-connections(200)); }; and source remote_2 { tcp(ip(0.0.0.0) port(514) max-connections(200)); }; [root@ms30snllx opt]# netstat -pan |grep syslog tcp 0 0 0.0.0.0:601 0.0.0.0:* LISTEN 22113/syslog-ng tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 22113/syslog-ng udp 3328 0 0.0.0.0:514 0.0.0.0:* 22113/syslog-ng But when I add a new source and have it listen on 1514 for example: source remote_3 { tcp(ip(0.0.0.0) port(1514) max-connections(200)); }; I don't get a listener on 1514 as well when looking via netstat . Is there something I am missing? Thanks in advance,

2 2