- syslog-ng - lists.balabit.hu

Insert hostname instead of overwrite ?
by stucky 03 Sep '10

03 Sep '10

Guys I'm trying to log to a loadbalanced VIP. It seems to work ok except that the loadbalancer uses SNAT so I loose my source IP. This means I cannot use dns or even the source ip to get the source host as all logs appear to come from the same source (the loadbalancer). This means I have no choice but to rely on the hostname field which works about 98% of the time but some stuff like Dell OpenManage skips the hostname field. So I'd get logs like this on host "cage" f.e. Aug 16 21:47:22 Server Administrator: Storage Service EventID: 2242 The Patrol Read has started.: Controller 0 (PERC 5/i Integrated) I fixed that by telling the syslog-ng client to force itself to figure out a proper hostname and now the log looks like this Aug 17 13:51:10 cage Administrator[]: Instrumentation Service EventID: 1000 Server Administrator starting I thought syslog-ng inserts the hostname but by the looks of it it simply replaces whatever is in the expected field with the hostname it has just figured out. As you can see it overwrote the entry "Server". No biggie in the above case but what if this field contained valuable information ? I'd loose that. Any way to squeeze in the hostname so to speak ? -- stucky

5 12

[PATCH] remove auto-generated files
by chris packham 03 Sep '10

03 Sep '10

INSTALL is generated by the build process. If the build host has a different version of autotools then the contents of INSTALL can change which in turn causes problems for developers working from the git repository. This patch removes the INSTALL file and adds it to .gitignore. --- Hi Bazsi, This has been causing us a little bit of a hassle with rebasing our syslog-ng clone against the upstream one. Hopefully it doesn't cause problems for your build processes. .gitignore | 1 + INSTALL | 182 ------------------------------------------------------------ 2 files changed, 1 insertions(+), 182 deletions(-) delete mode 100644 INSTALL diff --git a/.gitignore b/.gitignore index b2bfbec..b5e59f6 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,4 @@ stamp-h ylwrap .*.swp *.pyc +INSTALL diff --git a/INSTALL b/INSTALL deleted file mode 100644 index 47bbab8..0000000 --- a/INSTALL +++ /dev/null @@ -1,182 +0,0 @@ - -Installation instructions for SYSLOG-NG -======================================= - -Welcome. This is syslog-ng, which stands for syslog-new-generation, a new, -enhanced system logging daemon. - -Unpacking the distribution -========================== - -The distribution arrives in .tar.gz format though OS/distribution packaging -is possible. The file is named: - - syslog-ng-x.xx.tar.gz - -where x.xx stands for the version number. You must have tar and gzip to -unpack the distribution (sorry, compress is not supported). If you have GNU -tar simply execute the following command: - - tar xvfz syslog-ng-x.xx.tar.gz - -If your version of tar doesn't support z (most non-GNU tars), you should -execute this one: - - gunzip -c syslog-ng-x.xx.tar.gz | tar xvf - - -After this, you'll get a directory named syslog-ng-x.xx, where the source for -syslog-ng will be unpacked. - -Compiling the program: -====================== - -syslog-ng requires gcc as a C compiler (at least version 2.7.2), GNU flex as -a lex, and bison as a parser generator. Some GNU C and GNU flex extensions -are used, porting to other compilers/lex/yacc combination is welcome. - -Syslog-ng relies on a number of third party libraries in order to be -compiled, these are: - * libnet if spoof-source support is enabled in configure - (--enable-spoof-source) - * libwrap (aka TCP wrappers) if their use is enabled in configure - (--enable-tcp-wrapper) - * Glib a generic I/O library used by a wide variety of applications - * EventLog a generic event logging library developed by BalaBit - -Once these libraries are installed, you can start compiling syslog-ng: - -cd to the syslog-ng-x.xx directory, and execute the following commands: - - ./configure - make - -After the make cycle finishes, you'll get an executable in the src -directory: - - syslog-ng - the main binary - -Now do a "make install" and you are done. - -Compile time options -==================== -A couple of features must be enabled in compile time using one of the ---enable-<feature> option to the configure script. - -Currently the following compile time features exist: - - --enable-debug include debug info - --enable-sun-streams enable Sun STREAMS support even if not detected (autodetected by default) - --enable-sun-door enable Sun door support even if not detected (autodetected by default) - --enable-tcp-wrapper enable using /etc/hosts.deny & /etc/hosts.allow for TCP access (disabled by default) - --enable-spoof-source enable spoof_source feature (also requires libnet) (disabled by default) - --enable-ipv6 enable support for IPv6 - --enable-static-linking compile syslog-ng as a static binary - --disable-dynamic-linking compile syslog-ng against system libraries - dynamically, and statically against everything else - -NOTE: if you intend to use an NFS mounted /usr you might need to configure -syslog-ng with either --enable-static-linking or with ---disable-dynamic-linking as syslog-ng needs to start _before_ your -networking is up. - -Platform specific compilation issues -==================================== - - HP-UX with gcc 4.x - ------------------ - - The gcc available for HP-UX gives an error message in sys/socket.h, as a - function is defined as static and extern at the same time. Earlier gcc - versions and the HP compiler only gives a warning, gcc4 issues an error. - - The solution is to copy sys/socket.h to your gcc-private include - directory and fix the offending declaration. - -Configuration file: -=================== - -Syslog-ng uses a different configuration scheme than the original syslogd, -which sits at /etc/syslog-ng/syslog-ng.conf (or at a different location -depending the value passed to the --sysconfdir configure parameter). - -The manpage for syslog-ng.conf(5) or the documentation under doc contains a -/reference about keywords and syntax which can be used in the -config file. For now I only explain system dependencies. - -Every unix version has a slightly different way of sending log messages, and -since syslog-ng gives you the power of choosing your log-sources, you have to -be aware some of the internals. - - Linux: - ------ - Linux has a dedicated unix socket called /dev/log, where log messages are - written to, and read from. It is of type SOCK_STREAM. So the correct source - statement for standard linux log messages is: - - source stdlog { unix-stream("/dev/log"); }; - - Some newer Linux distributions (Debian GNU/Linux woody, and RedHat Linux - post 7.0) switched over to using SOCK_DGRAM in their sysklogd installation - by default. The libc autodetects which socket type is in use, but some - programs (like klogd) log directly to the log device bypassing libc. So if - you have logging problems you might want to switch log unix-dgram like - this: - - source stdlog { unix-dgram("/dev/log"); }; - - BSDi: - ----- - BSD is similar to Linux (or vice-versa Linux is similar to BSD, but this is - another issue), so BSD has also a unix socket for log communication, but - it's of type SOCK_DGRAM, and it is located at /var/run/log. So the source - statement you are looking for is: - - source stdlog { unix-dgram("/var/run/log"); }; - - Solaris (2.5.1 or below): - ------------------------- - - SunOS/Solaris has a universal means of communications called STREAMS. It is - used as both an in-kernel and kernel-user interface. You'll need to feed the - following statement to syslog-ng to accept all messages: - - source stdlog { sun-stream("/dev/log"); }; - - Solaris (2.6 - Solaris8) - ------------------- - - In addition to the STREAMS device used in earlier versions, a door is used to - make sure after each message that the system logging daemon is still running. - To create that door, you'll need the door() option of the sun-stream driver: - Sun has added a new method to the pool of possible IPC mechanisms, and it - is called door. syslog-ng supports this method with the sun-door keyword. A - door is a special file in the filesystem, and is called /etc/.syslog_door. - So your correct source statement would be: - - source stdlog { sun-streams("/dev/log" door("/etc/.syslog_door")); }; - - Solaris 9 - --------- - - The name of the door file has been changed from /etc/.syslog_door to - /var/run/syslog_door, the correct configuration needs to be: - - source stdlog { sun-streams("/dev/log" door("/var/run/syslog_door")); }; - - AIX (unknown revision) - ---------------------- - - AIX does support STREAMS, but its log transport doesn't use it. As it - seems /dev/log is a simple SOCK_DGRAM type unix socket, so it works using: - - source stdlog { unix-dgram("/dev/log"); }; - - HP-UX (HP-UX 11.0) - ------------------ - - HP-UX uses a named pipe called /dev/log for log transport, and you - can use this with the pipe() driver with an additional option. HP-UX pads - all incoming messages to 2048 bytes by default, so you need to specify - this: - - source stdlog { pipe("/dev/log" pad_size(2048)); }; -- 1.7.2.2

2 1

SNMP Traps?
by Clayton Dukes 03 Sep '10

03 Sep '10

Hey guys, A while back, I though I read that syslog-ng would process traps as well in v3.x, was I just imagining that or did it happen? ______________________________________________________________ Clayton Dukes ______________________________________________________________

2 3

TCP recv bug in syslog-ng v2.09?
by Clayton Dukes 02 Sep '10

02 Sep '10

Hey guys, Are there any known bugs for syslog-ng v2.09 that won't allow a cisco router to send logs over tcp? I can see a connection established in syslog-ng. I also see the message come in via tcpdump, but nothing in syslog-ng's output. If I change the router from tcp to udp, messages come in as expected. *Router config:* logging source-interface Loopback0 logging 172.18.224.150 <tricon:40,-1|172.18.224.150;majoshi@cisco.com> logging host 172.18.224.190 <tricon:40,-1|172.18.224.190;majoshi@cisco.com>transport tcp *syslog-ng config:* source s_all { udp(); tcp(ip(11.31.130.99) port(8002) max-connections(300)); tcp(ip(172.18.224.190) port(601) max-connections(300)); }; *debug output:* I commented out the line above for the other interface (11.31.130.99), restarted and this is all I see: Syslog connection accepted; from='AF_INET(14.3.23.50<tricon:40,-1|(14.3.23.50;majoshi@cisco.com>:63845)', to='AF_INET(172.18.224.190 <tricon:40,-1|(172.18.224.190;majoshi@cisco.com> :601)' *tcpdump:* 14:13:46.914566 IP (tos 0x0, ttl 251, id 4303, offset 0, flags [none], proto TCP (6), length 134) 14.3.23.50.63845 > xxx.com.601: Flags [.], seq 230:324, ack 1, win 4128, length 94 *Router debug:* *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:19.772<tricon:40,-1|.772;majoshi@cisco.com>: %SYS-5- <tricon:40,-1|-5-;majoshi@cisco.com>CONFIG_I: Configured from console by pnoc on vty0 (172.18.224.151) <tricon:40,-1|0 (172.18.224.151);majoshi(a)cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:20.776<tricon:40,-1|.776;majoshi@cisco.com>: Released port 15205 <tricon:40,-1|15205;majoshi@cisco.com> in Transport Port Agent for TCP IP type 1 delay 240000 <tricon:40,-1|240000;majoshi@cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:20.776<tricon:40,-1|.776;majoshi@cisco.com>: TCB 0x850 <tricon:40,-1|850;majoshi@cisco.com>F9754<tricon:40,-1|9754;majoshi@cisco.com>destroyed *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 created *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 setting property TCP_PID (8) 845083 <tricon:40,-1|(8) 845083;majoshi(a)cisco.com>E4 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 setting property TCP_NO_DELAY (1) 845083 <tricon:40,-1|(1) 845083;majoshi(a)cisco.com>E8 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 setting property TCP keepalive timeout (17) 845084 <tricon:40,-1|(17) 845084;majoshi(a)cisco.com> A0 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCP: Random local port generated 63845<tricon:40,-1|63845;majoshi@cisco.com>, network 1 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 bound to 14.3.23.50.63845<tricon:40,-1|14.3.23.50.63845;majoshi@cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: Reserved port 63845 <tricon:40,-1|63845;majoshi@cisco.com> in Transport Port Agent for TCP IP type 1 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCP: sending SYN, seq 3300233565 <tricon:40,-1|3300233565;majoshi@cisco.com>, ack 0 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCP0: Connection to 172.18.224.190<tricon:40,-1|172.18.224.190;majoshi@cisco.com>:601, advertising MSS 536 <tricon:40,-1|536;majoshi@cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCP0: state was CLOSED -> SYNSENT [63845 - <tricon:40,-1|63845 -;majoshi(a)cisco.com>> 172.18.224.190(601)<tricon:40,-1|172.18.224.190(601);majoshi@cisco.com> ] *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.779<tricon:40,-1|.779;majoshi@cisco.com>: TCP0: state was SYNSENT -> ESTAB [63845 - <tricon:40,-1|63845 -;majoshi(a)cisco.com>> 172.18.224.190(601)<tricon:40,-1|172.18.224.190(601);majoshi@cisco.com> ] *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.779<tricon:40,-1|.779;majoshi@cisco.com>: TCP: tcb 83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 connection to 172.18.224.190 <tricon:40,-1|172.18.224.190;majoshi@cisco.com>:601, peer MSS 1460 <tricon:40,-1|1460;majoshi@cisco.com>, MSS is 536<tricon:40,-1|536;majoshi@cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.779<tricon:40,-1|.779;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 connected to 172.18.224.190.601 <tricon:40,-1|172.18.224.190.601;majoshi@cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.779<tricon:40,-1|.779;majoshi@cisco.com>: %SYS-6- <tricon:40,-1|-6-;majoshi@cisco.com>LOGGINGHOST_STARTSTOP: Logging to host 172.18.224.190 <tricon:40,-1|172.18.224.190;majoshi@cisco.com> port 601 <tricon:40,-1|601;majoshi@cisco.com> started - reconnection ______________________________________________________________ Clayton Dukes ______________________________________________________________

5 15

v3.0.8: How to logging messages with non-rfc timestamps?
by Sergey V. Lobanov 02 Sep '10

02 Sep '10

I'm using syslog-ng v3.0.8(OSE) for logging messages from remote devices. There is a host which sends messages with incorrect timestamp format, for example "Jan 19 15:52:7". Syslog-ng does not store the first word in timestamp via macros $MSGHDR. For example: $ echo "<134>Jan 19 15:52:7 test" | nc -u 192.168.3.142 514 ^C But log file does not contains the word 'Jan': Aug 29 16:49:10 10.147.0.202 10.147.0.202 19 15:52:7 test Configuration file: @version: 3.0 options { use_dns(yes); }; source src_remote { udp(ip("0.0.0.0") port(514) flags(store-legacy-msghdr)); tcp(ip("0.0.0.0") port(514) flags(store-legacy-msghdr)); }; template t_remote {template("$DATE $SOURCEIP $HOST_FROM $MSGHDR$MESSAGE\n"); template_escape(no); }; destination remoteall { file("/var/log/all-remote.log" template(t_remote)); }; log { source(src_remote); destination(remoteall); }; How can I store the original timestamp from the remote host? -- wbr, Sergey V. Lobanov

2 2

Syslog-ng on OpenBSD
by Joe McDonagh 02 Sep '10

02 Sep '10

Nothing is being logged except Log Processing Statistics in /var/log/debug. I am seeing a ton of dropped stuff to my loghost, but what's really alarming is that stuff isn't being logged locally? Sep 2 11:10:02 machine syslog-ng[4179]: Log statistics; dropped='tcp(localhost:61514)=48833', processed='center(queued)=52', processed='center(received)=13', processed='destination(messages)=13', processed='destination(mailinfo)=0', processed='destination(mailwarn)=0', processed='destination(console)=0', processed='destination(mailerr)=0', processed='destination(loghost)=13', processed='destination(authlog)=0', processed='destination(user)=0', processed='destination(lpr)=0', processed='destination(daemon)=0', processed='destination(cron)=0', processed='destination(kern)=0', processed='destination(mail)=0', processed='destination(debug)=13', processed='destination(syslog)=13', processed='destination(console_all)=0', processed='source(src)=13', suppressed='tcp(localhost:61514)=0' This is happening on all my OpenBSD machines I recently setup to use syslog-ng (needed TCP with stunnel in front to send to my log host). This is the config: # This file is managed by puppet as a file in the syslog::client class options { long_hostnames(off); sync(20); use_dns(no);}; source src { internal(); pipe("/dev/klog" log_prefix("kernel: ")); unix-stream("/dev/log"); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination mail { file("/var/log/mail.log"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; destination loghost { tcp("localhost" port(61514)); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_debug { not facility(auth, authpriv, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); destination(loghost); }; <<EOF>> I'm wondering if my source line is just wrong for OpenBSD. Anybody with a working OpenBSD config care to share? -- Joe McDonagh AIM: YoosingYoonickz IRC: joe-mac on freenode "When the going gets weird, the weird turn pro."

2 2

Rewrite Rule Syntax Confusion
by Matthew Hall 02 Sep '10

02 Sep '10

Hello all, I am trying to make a combination of a template and a rewrite rule to write my messages into an extension of WELF format to make them easier to process downstream (the entire point of patterndb I guess). The template part was trivial and works perfectly. I just used some regex hacking to extract all 45 variable names I used in my patterndbs, then used gawk to dump them out into a giant (escaped) string like this, and pasted it to the config file. template("var1=\"$var1\" var2=\"$var2\" ...\n"); One minor thing: Currently I am forced to expand varfoo="$varfoo" even if the value of $varfoo is empty because a particular message did not contain "$varfoo". I suspect I could fix this by writing a C plugin which checks the length before expanding but I wondered if there were an easier way. Else maybe we could make this WELF output techniquie available for everybody because I think the problem could be very common. In any case I can always make the downstream ignore empty expansions for now. The only problem: I want one field at the end of the message to be named 'raw' and contain a double-quote-escaped copy of the raw message. That way if the message contains double quote characters it won't break a parser because they will be escaped right. Here is how I thought of doing this after reading the manual: rewrite r_add_raw { set(subst("\"", "\\\"", value("$MSGHDR$MSG"), flags("global")), value("raw")); } However I am getting hit with this syntax error: WARNING: Your configuration uses a newly introduced reserved word as identifier, please use a different name; keyword='subst', filename='welf.conf', line='2' Apparently I did it wrong, or there is a reason I can't call set on my raw variable to set the raw variable to the double quote escaped string subst'ed from input message in $MSGHDR$MSG. I really hope somebody can comment about how to fix it so that double quotes in the input won't blow things up. For now I worked around it temporarily just to get up and running by adding raw=\"$MSGHDR$MSG\" to the end of my template just to see if it would work OK and it does work OK when you don't have double quotes in there. Matthew.

2 1

Latest and greatest PatternDBs
by Matthew Hall 02 Sep '10

02 Sep '10

Hello all, Thanks to the great help you guys provided earlier I have gotten the hang of patterndb. I am still working on whether I can open-source mine or not, I hope my employer will allow it. I am wondering if this file is the latest and greatest? It's sort of old. http://www.balabit.com/downloads/files/patterndb-snapshot/patterndb-2009120… Thanks, Matthew.

2 1

configure installation path in a on-interactive installation
by Hoenig, Stefan, VF-Group 02 Sep '10

02 Sep '10

Hi there, is it possible to install syslog-ng PE to another path than the default /opt/syslog-ng and use this argument in a non-interactive installation. I tried to configure it by using the .run installer but no option is displayed to change the path. Any ideas or commentrs ??? With best regards / Mit freundlichen Grüßen Stefan Hoenig

2 1

syslog-ng 3.1.2-1 problem/bug/?
by VDR User 02 Sep '10

02 Sep '10

Hi. I'm using Debian testing and "upgraded" from 3.1.1-3 to 3.1.2-1 earlier. Now I'm getting "Error opening file for writing; filename='/logs/vdr.log', error='Permission denied (13)'".. This problem does _not_ occur with 3.1.1-3, which I have downgraded back to (until the problem/bug is solved). Are there any known issues causing this? I don't believe there are any permission problems considering the user owns that dir and it works fine in 3.1.1-3. Following is the diff between the syslog-ng.conf's. The - lines are from my working 3.1.1-3 conf, the + lines are from the 3.1.2-1 conf.... Any help is appreciated. Best regards, Derek --- /etc/syslog-ng/syslog-ng.conf 2010-08-15 12:01:35.000000000 -0700 +++ /etc/syslog-ng/syslog-ng.conf.dpkg-new 2010-08-04 12:07:22.000000000 -0700 @@ -6,7 +6,8 @@ # First, set some global options. options { long_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no); - owner("root"); group("adm"); perm(0640); + owner("root"); group("adm"); perm(0640); stats_freq(0); + bad_hostname("^gconfd$"); }; ######################## @@ -32,10 +33,10 @@ destination d_auth { file("/var/log/auth.log"); }; destination d_cron { file("/var/log/cron.log"); }; destination d_daemon { file("/var/log/daemon.log"); }; -destination d_kern { file("/var/log/kern.log" template("$FULLDATE $MESSAGE\n")); }; +destination d_kern { file("/var/log/kern.log"); }; destination d_lpr { file("/var/log/lpr.log"); }; destination d_mail { file("/var/log/mail.log"); }; -destination d_syslog { file("/var/log/syslog" template("$FULLDATE $MESSAGE\n")); }; +destination d_syslog { file("/var/log/syslog"); }; destination d_user { file("/var/log/user.log"); }; destination d_uucp { file("/var/log/uucp.log"); }; @@ -106,7 +107,7 @@ local6, local7) and not filter(f_debug); }; filter f_mail { facility(mail) and not filter(f_debug); }; filter f_news { facility(news) and not filter(f_debug); }; -filter f_syslog3 { facility(syslog) and not filter(f_debug); }; +filter f_syslog3 { not facility(auth, authpriv, mail) and not filter(f_debug); }; filter f_user { facility(user) and not filter(f_debug); }; filter f_uucp { facility(uucp) and not filter(f_debug); }; @@ -152,14 +153,3 @@ # All messages send to a remote site # #log { source(s_src); destination(d_net); }; - - -######################## -# VDR LOGGING -######################## -destination d_vdr { file("/logs/vdr.log" template("$FULLDATE $MESSAGE\n") owner("test") group("staff") perm(0640)); }; - -filter f_vdr { program("vdr"); }; -filter f_novdr { not program("vdr"); }; - -log { source(s_src); filter(f_vdr); destination(d_vdr); };

2 3