- syslog-ng - lists.balabit.hu

Problems using the syslog-protocol flag
by Andreas Maechler 14 Nov '10

14 Nov '10

Hi all Running syslog-ng 3.2beta1 on FreeBSD, I'm trying to use the 'syslog-protocol' flag in a unix-dgram source: source s_local { unix-dgram("/var/run/log" flags(syslog-protocol)); unix-dgram("/var/run/logpriv" perm(0600)); file("/dev/klog" follow-freq(0) program-override("kernel") flags(no-parse)); internal(); }; That option seems to be ignored though. If I force the option by setting it manually in afsocket_sd_init_instance(), afsocket.c, all works well and incoming messages get parsed according to IETF. Am I missing something or is this a bug? Thanks in advance. Andreas

2 1

CSV parser and empty fields
by Bill Anderson 14 Nov '10

14 Nov '10

I'm using a tab separated format from apache for access logs. My last two fields are referrer and user-agent. Obviously sometimes there is no referrer. Unfortunately when there isn't one apache only logs an empty string instead of the more common "-". This isn't a problem in scripts that parse the resulting logfile as they see the resulting empty field when I log $MSG. However, I just started a new log file that uses the csv-parser w/tab as delimiter and when the referrer field is empty, APACHE.USERAGENT (the last field) gets rolled into APACHE.REFERRER, the second to last field. As a result the template for this page (which uses APACHE.REFERRER) isn't reliable. When REFERRER is empty I want it to be empty (or something I can specify, like a default) not he next field in the parser definition. I've look at the manual and don't see anything about handling empty fields. How do I get syslog-ng/csv-parser to log the empty field instead of moving to the next one? Cheers, Bill

4 10

Not able to recive all syslog messages
by add gy 13 Nov '10

13 Nov '10

Hi, I have installed syslog-ng on RHEL server as log host server for 250 router , switches but some time i recive messages some times i dont , when i check it on other syslog server on windows i revice syslog messages with any problem. Request to please review syslog-ng config file and give some suggetion. config file ------------------------------------------------------------------------------------------------------------------------- # configuration file for syslog-ng, customized for remote logging # source s_internal { internal(); }; destination d_syslognglog { file("/var/log/syslog-ng.log"); }; log { source(s_internal); destination(d_syslognglog); }; # Local sources, filters and destinations are commented out # If you want to replace sysklogd simply uncomment the following # parts and disable sysklogd # # Local sources # #source s_local { # unix-dgram("/dev/log"); # file("/proc/kmsg" log_prefix("kernel:")); #}; # # Local filters # #filter f_messages { level(info..emerg); }; #filter f_secure { facility(authpriv); }; #filter f_mail { facility(mail); }; #filter f_cron { facility(cron); }; #filter f_emerg { level(emerg); }; #filter f_spooler { level(crit..emerg) and facility(uucp, news); }; #filter f_local7 { facility(local7); }; # # Local destinations # #destination d_messages { file("/var/log/messages"); }; #destination d_secure { file("/var/log/secure"); }; #destination d_maillog { file("/var/log/maillog"); }; #destination d_cron { file("/var/log/cron"); }; #destination d_console { usertty("root"); }; #destination d_spooler { file("/var/log/spooler"); }; #destination d_bootlog { file("/var/log/boot.log"); }; # # Local logs - order DOES matter ! # #log { source(s_local); filter(f_emerg); destination(d_console); }; #log { source(s_local); filter(f_secure); destination(d_secure); flags(final); }; #log { source(s_local); filter(f_mail); destination(d_maillog); flags(final); }; #log { source(s_local); filter(f_cron); destination(d_cron); flags(final); }; #log { source(s_local); filter(f_spooler); destination(d_spooler); }; #log { source(s_local); filter(f_local7); destination(d_bootlog); }; #log { source(s_local); filter(f_messages); destination(d_messages); }; # Remote logging source s_remote { tcp(ip(0.0.0.0) port(514)); udp(ip(0.0.0.0) port(514)); }; destination d_separatedbyhosts { file("/var/log/syslog-ng/$HOST/messages" owner("root") group("root") perm(0655) dir_perm(0744) create_dirs(yes)); }; log { source(s_remote); destination(d_separatedbyhosts); }; ------------------------------------------------------------------------------------------------------------------------ Regards, Add

4 14

Source udp driver and flags
by Yann I. 10 Nov '10

10 Nov '10

Hello List, I'm using the syslog-ng OSE version 3.1.2. Currently, I have a syslog-ng server which collects events from several devices : routers (Cisco), switches (Alcatel), other devices which send events to the syslog server by using the port 514 with the protocol UDP. For the router and the switch, I need to use the flag "no-parse" because I have to parse the content of the message by using "patterndb.xml". But... for the others devices I don't want to use the flag "no-parse" because the events respect the syslog format. I think it's not possible to configure syslog-ng like this : source s_udp_01 { udp (flags(no-parse); }; source s_udp_02 { udp (); }; log { source (s_udp_01); (...) }; log { source (s_udp_02); (...) }; The workaround could be the modification of udp port destination for the devices but it's not possible for the switch Alcatel. For the router Cisco, I don't know if it's possible or not... Someone would have an idea for that "problem" ? Regards, Yann I.

3 4

clearing log files
by vijay 10 Nov '10

10 Nov '10

hi all, In my system /var/log all syslog files are accumulating.Is there any way to delete files automatically. vijay

4 5

writing to Database
by vijay 10 Nov '10

10 Nov '10

Hi All, Iam writing syslog-ng entries in to database by configuring in syslog-ng.conf like below destination d_oracle { pipe("/dev/ora.pipe" template ("INSERT INTO logs (LL_HOST, LL_facility, LL_priority,LL_level, LL_tag,LL_DATE, LL_program, LL_msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY','$LEVEL', '$TAG',to_date('$YEAR.$MONTH.$DAY $HOUR:$MIN:$SEC', 'yyyy.mm.dd hh24:mi:ss'),'$PROGRAM', substrc('$MSG',1,511));\n COMMIT;\n") template-escape(yes)); }; Iam writting logs from pipe to database.Iam using below script. nohup sqlplus UNAME/PWORD@IPADDRESS/orcl @/dev/ora.pipe > /dev/null &. Sometimes pipe is getting blocked.one reason we are suspecting is DB server restarting.How to handle these situations.Even the DB server restarting the script process is alive but it is not writing to DB. vijay

2 1

Linux Distribuitions using Syslog-NG
by Renato Gregio 10 Nov '10

10 Nov '10

Hi all, someone can tell me what distros are using Syslog-NG as the main system log? Att Renato Gregio

6 9

Re: [syslog-ng] Package for Mandriva distribution
by Guillaume Rousse 09 Nov '10

09 Nov '10

Le 08/11/2010 18:12, Yann I. a écrit : > Hello list ! > > I'm looking for the package "syslog-ng 3.1.2" for Mandriva but I can't > find it. Do you where I can find that package ? It doesn't exist anymore. The latest stable version (2010.1) has syslog-ng 3.1.1, while the development version (cooker) has switched to 3.2.0beta1. If you really want the 3.1.2, you have to rebuild the previous package from mandriva subversion repository (http://svn.mandriva.com) -- BOFH excuse #175: OS swapped to disk

1 0

Package for Mandriva distribution
by Yann I. 09 Nov '10

09 Nov '10

Hello list ! I'm looking for the package "syslog-ng 3.1.2" for Mandriva but I can't find it. Do you where I can find that package ? Regards, Yann I.

2 2

Determining when logging is quiescent
by Ben Tisdall 06 Nov '10

06 Nov '10

Hi all, I'm setting up logging from ec2 instances that will get destroyed when they've finished their work. Most of the log sources use the file driver. Assuming the application has itself finished writing logs, is there any way of determining, from the client end, when syslog-ng has finished reading all of them? Regards, Ben Tisdall Photobox

2 2