- syslog-ng - lists.balabit.hu

Two or more conditions on a action
by C. L. Martinez 20 Jun '12

20 Jun '12

Hi all, Is it possible to configure two or more conditions under an action?? For example: <action trigger="match" condition=" '${first_field}@1' == 'something_1' & '${second_field}' == 'something_2' "> This action it doesn't works ... I am using syslog-ng 3.3.5 Thanks.

3 6

Include doesn't work
by Jakub Prokeš 20 Jun '12

20 Jun '12

Hi! I use syslog-ng for logging through network, but for some hosts I need special configs. I created directory /etc/syslog-ng/syslog-ng.conf.d and in there create file with config which is attached and include it in main conf file: ## include here config of clients with special options include syslog-ng.conf.d/; ## common clients log { source(s_clients); source(s_local); filter(f_std_facility); destination(d_host_facility); }; The result is syntax error in configuration: [root@logger:/etc]# syslog-ng -s -d Adding include file; filename='001-sample.conf' Starting to read include file; filename='/etc/syslog-ng/syslog-ng.conf.d/001-sample.conf', depth='1' syntax error in /etc/syslog-ng/syslog-ng.conf.d/001-sample.conf at line 1. syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng [root@logger:/etc]# syslog-ng --version syslog-ng 3.1.3 Installer-Version: 3.1.3 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#def34661b08109f8148904b860457d5747c425b3 Compile-Date: Feb 1 2011 19:11:59 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: on Enable-Pcre: on Can you help me? Regards, -- Jakub Prokes Senior Linux Administrator m: podpora(a)superhosting.cz w: www.superhosting.cz | www.datacamp.sk [CZ]: +420 296 826 296 | Na Safrance 33, Praha 10 - Vinohrady [SK]: +421 (2) 2025 6256 | Bozeny Nemcovej 8, Bratislava

2 1

cipher_suite param support ?
by Balla, Hithendra (EXT-Other - IN/Bangalore) 20 Jun '12

20 Jun '12

Hi all, Can somebody provide the following information. 1) Which version of syslog-ng provides support for cipher suite parameter, so that there is a possibility to configure the strong ciphers. 2) Does cipher suite parameter is available in 3.2 ? Thanks Hithendra

3 5

Re: [syslog-ng] issue with rewrite. Please help.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 19 Jun '12

19 Jun '12

Hi Balint and all, Can you guide us here on what might be the issue ? Thanks Hithendra -----Original Message----- From: Balla, Hithendra (EXT-Other - IN/Bangalore) Sent: Monday, June 18, 2012 6:53 PM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] issue with rewrite. Please help. Hi Balint, Thanks for the reply. I tried the below rewrite rewrite r_solaris { subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") type("pcre") flags(dont-store-matches)); }; It works for auth.info, but it does not work with local7.info or local6.info as the regex does not handle numerals in the facility field. I tried changing it as follows (i.e. added [0-9] before .)., but with this, this dumps core. Addition of any numeral in this position results in a core dump subst("\[ID [0-9]* [a-z]*[0-9]\.[a-z]*\]\ " "" value("MESSAGE") We have tried the following. logger -p local7.info "HELLO|KUAAA" --> Did not work logger -p local6.info "HELLO|KUAAA" --> Did not work logger -p auth.info "Accepted password for root" --> Worked. Thanks Hithendra -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu on behalf of ext Balint Kovacs Sent: Fri 6/15/2012 10:26 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] issue with rewrite. Please help. Hi Hithendra, I came across this problem just recently, I guess that you want to handle Solaris logs with the standard Unix analysis ruleset, but the these tags are in the way. The only difference is, that I moved the tag to the end of the message (as patterndb does prefix matching, these don't bother my patterns but are still there). My rewrite rule is the following: rewrite r_solaris { #move the solaris header to the end of the message #to work with linux patterndb subst("(\[ID [0-9]* [a-z]*\.[a-z]*\])\ " "" value("MESSAGE") type("pcre") flags(store-matches)); subst("$" " $1" value("MESSAGE") type("pcre")); }; If you don't want to move it (backreferencing is quite slow and resource-intensive), you could just use this untested version: rewrite r_solaris { subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") type("pcre") flags(dont-store-matches)); }; HTH, Balint On 06/15/2012 05:39 AM, Balla, Hithendra (EXT-Other - IN/Bangalore) wrote: > > Hi all, > > We have the followinglog > > 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6*[ID 800047 > auth.info]*Accepted publickey for xyz > > We wanted to replace*[ID 800047 auth.info]*with*empty > string*(i.e."")and print the following > > 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 Accepted publickey for xyz > > So we have used the below re-write with subst. But this is not > workingin*syslog-ng 3.4.0alpha2*. > > rewrite rw_msg{*subst*("\\[.*\\]", "", value("MESSAGE"));}; > > Can somebody help out here? > > Thanks > > Hithendra > > > > ________________________________________________________________________ ______ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq >

1 0

Writes garbled kernel messages to logs
by shih dane 18 Jun '12

18 Jun '12

Hi All Lately I've setup syslog server on Fedora 12 l want to get iscsi connection log but get some garbled kernel messages like this Jun 8 09:56:12 F12DANE kernel: 6MxusadnRT 1 Jun 8 09:56:12 F12DANE kernel: 6DtPUnre: Ys<>aaeunenre: e Jun 8 09:56:12 F12DANE kernel: 6Erreoeyee: 0<>esoTp: oml<>---------------------------------<>AGTCR[SS] eitrdfbi_espr ff82d810<>SS oi ucsflo I:1fo 7.66.4 o121.51736, Jun 8 09:56:12 F12DANE kernel: 6IceetdiCICneto on o1fo oe q.910.o.irsf:aep Jun 8 09:56:12 F12DANE kernel: 6EtbihdiCIssinfo oe q.910.o.irsf:aep Jun 8 09:56:12 F12DANE kernel: 6Iceetdnme fatv SS esost niCITre otlGop Jun 8 09:56:15 F12DANE kernel: Received iSCSI login reques rm121.419o C ewr otl121.51736 Jun 8 09:56:15 F12DANE kernel: tfo 7.66.4 nTPNtokPra 7.66.7:20<>---------------------------------<>uhehd oe<>edriet oe<>aaiet oe<>aRcDtSgetegh 53 Jun 8 09:56:15 F12DANE kernel: 6--------------------------------- Jun 8 09:56:15 F12DANE kernel: 6--------------------------------- Jun 8 09:56:15 F12DANE kernel: 6Iiitrae in19-5cmmcootdn-c<>agtla: I agt<>agtotlruTg Jun 8 09:56:15 F12DANE kernel: 6DfutieWi: 2<>ealTm2ean 0<>esoTp: icvr Jun 8 09:56:15 F12DANE kernel: 6--------------------------------- Jun 8 09:56:15 F12DANE kernel: 6TRE_OEiCI:Rgsee arcss_t:ff800208 Jun 8 09:56:15 F12DANE kernel: 6iCILgnscesu nCD rm121.419t 7.66.7:201<>nrmne SS oncincutt rmnd:in19-5cmmcootdn-c<>salse SS eso rmnd:in19-5cmmcootdn-c<>nrmne ubro cieiCIssin o1o SS agtPra ru:1<>ermne SS onci syslog-ng version : syslog-ng 3.3.1 syslog-ng.conf @version: 3.3 @include "scl.conf" options { stats_freq(0); create_dirs(yes); dir_perm(0777); perm(0644); }; source src { system(); internal(); udp(); }; destination information { file("/raid/syslog/information"); }; destination error { file("/raid/syslog/error"); }; destination warning { file("/raid/syslog/warning"); }; filter f_info { level(info); }; filter f_error { level(error); }; filter f_warning { level(warning); }; log { source(src); filter(f_info); destination(information); }; log { source(src); filter(f_error); destination(error); }; log { source(src); filter(f_warning); destination(warning); }; Thanks for any advice Best Regard Dane

2 4

how can i get usb and printer detailed logs with syslog-ng
by ismail başaran 18 Jun '12

18 Jun '12

Hi, İ am using ubuntu 11.04. My server machine and clients ubuntu 11.04. i am trying to get usb and printer detailed logs. i can see usb connect and disconnect logs. But i want to see what operations execute on it like copied file name or printed file name. How can i achive this. thanks -- İsmail BAŞARAN http://www.softera.com.tr

2 1

issue with rewrite. Please help.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 15 Jun '12

15 Jun '12

Hi all, We have the following log 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 [ID 800047 auth.info] Accepted publickey for xyz We wanted to replace [ID 800047 auth.info] with empty string (i.e. "") and print the following 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 Accepted publickey for xyz So we have used the below re-write with subst. But this is not working in syslog-ng 3.4.0alpha2. rewrite rw_msg{subst("\\[.*\\]", "", value("MESSAGE"));}; Can somebody help out here? Thanks Hithendra

2 1

Re: [syslog-ng] issue with rewrite. Please help.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 15 Jun '12

15 Jun '12

Can somebody help here on this issue? _____________________________________________ From: Balla, Hithendra (EXT-Other - IN/Bangalore) Sent: Friday, June 15, 2012 9:09 AM To: 'Syslog-ng users' and developers' mailing list' Subject: issue with rewrite. Please help. Hi all, We have the following log 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 [ID 800047 auth.info] Accepted publickey for xyz We wanted to replace [ID 800047 auth.info] with empty string (i.e. "") and print the following 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 Accepted publickey for xyz So we have used the below re-write with subst. But this is not working in syslog-ng 3.4.0alpha2. rewrite rw_msg{subst("\\[.*\\]", "", value("MESSAGE"));}; Can somebody help out here? Thanks Hithendra

2 1

syslog-ng 3.3.4 Coredumps on AIX 5.2
by Divya Vikraman 15 Jun '12

15 Jun '12

Hello ALL, I have compiled syslog-ng 3.3.4 version using dynamic linking. But , while trying to run syslog-ng it coredumps # /opt/soe/local/syslog-ng-3.3.4/sbin/syslog-ng -F Memory fault(coredump) # I have compiled glib-2.19.7 with the (--enable-static and --with-libiconv) option After searching over the net for some possibel solutions , i found that a possible solution for this is to use the AIX libiconv instead of the GNU one. If this is correct, then the issue is , glib-2 needs the GNU glib, if i try with the system one the make fails with the below error. "error GNU libiconv not in use but included iconv.h is from libiconv". So, I cannot use the system libiconv as glib-2 will fail to compile and if I use GNU libiconv syslog-ng coredumps. though, the configure and stages do not complaing anything. Has, anyone else faced this issue , please let me know how can I get this working. Best Regards, Divya.

2 1

syslog-ng maintenance changes
by Balazs Scheidler 15 Jun '12

15 Jun '12

Hi, I had a decreasing amount of time to work on syslog-ng in the past year, as you may have noticed by my absense on the mailing list, and the relative rarity of my blog posts. More and more is done by Algernon (aka Gergely Nagy), and I felt it to be incorrect to be the bottleneck in a number of cases. Even though Algernon is emloyed by BalaBit, his daily job didn't and doesn't mandate such close relationship with syslog-ng. That was his own motivation, and I think that is a key to maintaining or developing open source software. After talking to him in real life, we've decided to make a shift, he is going to maintain the 3.3 tree and making releases instead of myself. This will make 3.3 maintenance smoother, and free some precious time for me, which I'd use to work on the 3.4 features. The location of the syslog-ng trees will change too, they would be available at: git://github.com/balabit/syslog-ng-3.3.git git://github.com/balabit/syslog-ng-3.4.git or the web interface at: http://github.com/balabit I am certain that this change is for the better of syslog-ng, and I hope the conclusion of the community will be the same in a few months. I really thank him for helping me out. Cheers, Bazsi

4 5