- syslog-ng - lists.balabit.hu

Error starting syslog-ng
by Fabien Bagard 24 Jan '11

24 Jan '11

Hi list ! I have a problem to start syslog-ng. I got a syntax error on line in bold : ###### # sources # all known message sources source s_all { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); }; source s_unix { tcp( port(514) * tls(* key_file("/etc/syslog-ng/certs/logger.parrot.biz.key") cert_file("/etc/syslog-ng/certs/logger.parrot.biz.crt") ca_dir("/etc/syslog-ng/certs/CA/") peer_verify(optional-untrusted) ) ); }; But I can't figure out what ! Can someone point this error to me ? Thanks -- Fabien Bagard IT Department tel + 33 (0)1 48 03 60 40 -------------------------------------------------------------------------------- Parrot SA 174, Quai de Jemmapes | 75010 Paris - France tel + 33 (0)1 48 03 60 60 | fax + 33 (0)1 48 03 70 08 http://www.parrot.com -------------------------------------------------------------------------------- This e-mail message and any attached document(s) are for the sole use of the intended recipient(s)and may contain confidential and legally privileged information. Any unauthorized review, copy, use and/or disclosure is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original.

4 9

Syslog-ng error
by Shawn Cannon 24 Jan '11

24 Jan '11

I am trying to setup a second syslog-ng server that will be part of a load balanced cluster. When the 2nd server tries to connect to my mssql database, it tries to run the CREATE TABLE commands which fails because the table already exists since the first syslog-ng server already created them. How do I tell the 2nd server not to try the CREATE TABLE stuff so it will start working? Shawn Cannon IT Professional http://www.shawncannon.com Contact Me <http://www.linkedin.com/pub/shawn-cannon/5/84/81a> LinkedIn<http://www.linkedin.com/pub/shawn-cannon/5/84/81a> <http://www.facebook.com/rolltidega72> Facebook<http://www.facebook.com/rolltidega72> <http://twitter.com/rolltidega> Twitter <http://twitter.com/rolltidega> My blog: My thoughts on VMworld… a week later…<http://www.shawncannon.com/?p=19>

5 10

syslog-ng 3.1.3-2 - working examples of remote logging
by Steven Shepherd 21 Jan '11

21 Jan '11

OK, so syslog has come a long way and many configuration changes in the years :) Can someone provide working examples of (3.1.X) client/server syslog-ng.conf set up for remote logging purposes such as /var/log/messages, /var/log/kern.log, /var/log/auth.log...etc? Would want on local machine as well as remote syslog server. Will also want to remotely log apache access/error log via syslog-ng as well. Any help/tips/pointers is greatly appreciated! Cheers!

3 2

Open source version: syslog-ng-3.1.3-1.rhel5.i386.rpm
by julian 19 Jan '11

19 Jan '11

what install options are assumed for syslog-ng-3.1.3-1.rhel5.i386.rpm: server, relay, client? It is acting as relay.

3 2

oracle db + syslog-ng integration
by vijay 19 Jan '11

19 Jan '11

hi, Iam Using syslog-ng 3.0.4.when i used below configuration destination d_sql { sql(type(oracle) username("myusername") password("mypassword") database("LOGS") table("msgs_${R_YEAR}${R_MONTH}${R_DAY}") columns("datetime varchar(16)", "host varchar(32)", "program varchar(32)", "pid varchar(8)", "message varchar2") values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSGONLY") indexes("datetime", "host", "program", "pid", "message")); }; iam facing error while starting service syntax error in /usr/local/etc/syslog-ng.conf at line 322. syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng the line 322 is---------- sql(type(oracle) username("myusername") password("mypassword") vijay.p

2 3

syslog ng open version 3.1.3 does not relay or write to local file
by Bentayeb, Julian A. 18 Jan '11

18 Jan '11

I have syslog-ng-3.1.3-1.rhel5.i386.rpm open version installed and want syslog clients to send to the syslog-ng server; The intention is to have the server send all logs to a final syslog destination and a keep a copy in a file locally. The only thing that is working is I am seeing SYSLOG packest via tcpdump. No messages come to the local file and no messages go to the final destination. I installed the rpm and there was no mode option (server, relay, client) I could chose. Your help is appreciated. Here is the syslog conf I am using: @version:3.0 # # Relay all logs to final destination # options { mark_freq(30); keep_hostname(yes); }; source s_local { unix-stream("/dev/log"); internal(); }; source s_network { syslog(transport(udp)); }; destination d_syslog_udp { syslog("xx.xx.xx.xx" transport("udp") ); }; log { source(s_local); source(s_network); destination(d_syslog_udp); }; # # Keep a copy of logs coming over the network locally in a file for Splunk # source s_network { syslog(transport(udp));}; destination d_file { file("/var/log/messages" ); }; log { source(s_network); destination(d_file); }; Julian Bentayeb Lawrence Livermore National Laboratory Information and Communications Systems 925-424-5702

1 0

Syslogs from Router
by Christopher Petsch 18 Jan '11

18 Jan '11

I am trying to get my router (Netgear FVS338) to send syslogs to my computer but I cant seem to get it configured correctly. Ive googled for the past three days and come up short with little to no help and what little i did find i kept getting syntax errors for. I know I'm doing something wrong but I don't know what. If I could get some help on this or be pointed in a better direction it would be most appricated. Thank you in advance. -- Sincerely, Chris KeyID: 0x348DC808 Keyserver: pool.sks-keyservers.net

5 9

Performance of syslog-ng for Database access (mysql)
by Yu Watanabe 18 Jan '11

18 Jan '11

Hello all. I would like to ask question for the performance of syslog-ng when it is accessing to mysql database. I am using syslog-ng 3.0.9 and thinking of using either one of the method below for the database connection. 1. Using the program driver and fork the "mysql command" to execute the sql. 2. Use the sql driver to access to the table I was wondering which is more efficient for syslog-ng and the server itself (i.e. CPU , memory ) Any advice would be helpful! Thanks, Yu Watanabe

3 6

MongoDB destination driver
by Gergely Nagy 16 Jan '11

16 Jan '11

Greetings! I was contemplating switching one of the websites I maintain from postgresql to one of these document store things, and while wondering about how to evaluate the options best, I stumbled into a short article on the MongoDB website: http://blog.mongodb.org/post/172254834/mongodb-is-fantastic-for-logging, which promptly led me to start pondering about how hard - or easy, as it turns out - would it be to write a MongoDB destination driver for syslog-ng? Only four hours later, I can present you the mongodb destination driver, available from my git repo (note the -b option, it is important): $ git clone -b algernon/dest/mongodb git://git.madhouse-project.org/syslog-ng/syslog-ng-3.2.git Of course, one can browse the sources on the web too: http://git.madhouse-project.org/syslog-ng/syslog-ng-3.2/tree/modules/afmong… It is using the MongoDB C client library (http://www.mongodb.org/display/DOCS/C+Language+Center) - I simply embedded the sources for now, lacking a better option. Once compiled, one can already begin using it with the default options: destination d_mongodb { mongodb(); }; This will try to connect to localhost:27017, and use the logs collection in the syslog-ng database, and will log all the standard fields. Of course, all of those are configurable! To demonstrate all the - currently - available options, the destination definition above is the same as the following: destination d_mongodb { mongodb( host("localhost") port(27017) database("syslog-ng") collection("logs") keys("date", "facility", "level", "host", "program", "pid", "message") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "$FACILITY", "$LEVEL", "$HOST", "$PROGRAM", "$PID", "$MSGONLY") ); }; A few things, like authentication and some template options are not configurable yet, partly because I didn't figure out what they're good for, or how they work. But I will get there at some point, especially if there's interest in said features. All in all, I'm very happy that I could cook up a fairly simple destination driver within a few hours, having no prior experience writing one. The syslog-ng code is amazing, by the way, it was a breeze to navigate through and find the stuff I needed to make this driver work. Mind you, this is very new code, and I haven't tested it extensively, but I do have some great plans involving syslog-ng and mongodb >;) Hope you like the code, and perhaps find it useful! -- |8]

6 38

syslog-ng 3.2.2 has been released
by devel＠balabit.hu 16 Jan '11

16 Jan '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.2.2 SUMMARY : new stable release DATE : Jan 16, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.2.2) has been released. For latest fixes in the 3.2.x feature branch you are recommended to upgrade to this version. CHANGES: 3.2.2 Sat, 15 Jan 2011 13:50:35 +0100 Bugfixes: * Fixed a possible segmentation fault when the port number is changed for a TCP source, the configuration is reloaded and there were open connections for the old port, which send messages after the SIGHUP. This behaviour has been broken since 3.0.1. * Fixed a possible security issue on FreeBSD and on platforms where mode_t is an unsigned 16 bit value. On these platforms syslog-ng may be using 0xFFFF as the permission bits causing log files to be world readable/writable/executable/setuid. * Fixed leaking the contents of internal() messages (such as MARK or the statistics message). * Fixed current time tracking when calculating the time in the correllation engine. * When the patterndb file got reloaded the correllation state was dropped. This behaviour was fixed. * Really ignore invalid persist-state files, which caused syslog-ng startup to fail previously. * Added the missing support for blocks inside log {} statements. * Fixed a configuration init error when the same db-parser() instance is referenced from multiple log paths. * Fixed handling the port() options for SQL destinations. Platform specific: * Added cygwin support to the system() source. Build related: * syslog-ng modules are now linked with "-module -no-undefined" parameters, pdbtool and unit tests are using -dlpreopen when explicitly linking against such modules. * The core patterndb functionality got split off to a separate library installed to $libdir to make it easier to be used by pdbtool. * Fixed support for an explicit --exec-prefix configure parameter. Earlier if exec_prefix was different from prefix, the installation layout produced unworkable binaries. * If no OpenSSL libraries are available, pdbtool patternize still can work, although in this case proper UUID generation is not possible. * If syslog-ng is compiled against an old glib (earlier than 2.13), it'll not use an API that is present in newer ones. Please note however that there might be other similar compatibility issues with old Glib versions. * Updated cygwin packaging files. * Don't use -wno-pointer-sign in dbparser if gcc doesn't support it. This will emit a lot of warnings, but still make the code possible to compile with older gcc versions. Credits: syslog-ng is developed as a community project. All changes and improvements requires effort, and this effort is really appreciated. Writing code, testing changes or simply providing use-cases and information on one's setup will make syslog-ng better. Here are the people, listed in no specific order who made this release possible. * Balázs Németh (BalaBit) * Sándor Gellér (Morgan Stanley) * Péter Czanik (BalaBit) * Owen Mann (Interactive Data) * Zhengxiang Pan (Alcatel Lucent) * Corinna Vinschen (RedHat) * Eric Berggren (Apple) * Gergely Nagy (BalaBit) * Matthew Hall * LEBRETON Philippe * Craig Bell * Steven Chamberlain * Balázs Scheidler (BalaBit) Thanks for their efforts, it is appreciated. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0