- syslog-ng - lists.balabit.hu

Which of these config.php files should I use?
by Wagner Pereira 07 Jun '10

07 Jun '10

Hi, folks. I posted this issue in the cacti mailing list, but maybe the Syslog mailing list should be the better place to post this: ------------------ Hi, friends. After I've installed the syslog-ng plugin for cacti, there are much more files config.php than I'd like! See below: ------------------ /etc/syslog-ng/syslog/config.php /usr/share/cacti/site/include/config.php /var/www/cacti-0.8.1/include/config.php /var/www/cacti-0.8.1/plugins/syslog/config.php ------------------ In the /var/www/cacti-0.8.1/include/config.php one, I've the lines as follows (which is responsible to connect to the cacti database, right?): ------------------ $database_type = "mysql"; $database_default = "cacti"; $database_hostname = "localhost"; $database_username = "admin"; $database_password = "xxxxxxxxx"; $database_port = ""; ------------------ Even after I've made this below, I am still not able to see the Syslog tab in the Cacti web page: /mysqladmin --user=root -p create syslog / /mysql syslog///--user=root -p/// < syslog.sql/ Thanks in advance. Att, -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Tel. (11) 3091-8901

1 1

Quick Questions
by Dyne Lai 04 Jun '10

04 Jun '10

Hi Syslog-ng Developers, I have a few general questions regarding syslog-ng as below. 1) What is the type of transmission (Asynchronous/Synchronous) used for the transfer of log messages between server and remote client? 2) I understand that Syslog-ng is able to store unsent messages from remote client to server in the local hardisk during network/system outrage. Will syslog-ng be able to resume with the unsent messages upon the revive of the network/system? If possible, how can we configure/setup to achieve that? 3) In view of security, how can we configure remote client and server to perform authentication (using X.509 certificates) during log message forwarding? 4) Is the forwarding of log message between remote client and server consider real-time? (assume syn=0) Do pardon if the questions appears ignorant.Thanks for the time! Best Regards, Dyne Lai

5 7

mis-claimed features: network link compression w/ TLS
by Robin H. Johnson 04 Jun '10

04 Jun '10

The comparison table: http://www.balabit.com/network-security/syslog-ng/comparing/detailed/ Lists: "Support for network link compression when using TLS" But I can't find it in the OSE at all. There are NO calls to the OpenSSL COMP* functions, nor any usage of compression functions that I can find. The Flex and Yacc grammar DO include a 'compress' keyword, but data from it is not actually used. I'm looking for some reasonable compression to cut down on network traffic one some Gentoo boxes where there is a very limited upstream network connection. Traffic is about 2.4GiB/day, over a 1Mbit link. Plain gzip after the fact gets >90% compression, but I'd like the logs in near-realtime to the remote logging destinations (multiple). I do also realize that we're going to be limited by packet compression, unless we keep some form of running dictionary, but I think even with that, we should get a good size reduction. -- Robin Hugh Johnson Gentoo Linux: Developer, Trustee & Infrastructure Lead E-Mail : robbat2(a)gentoo.org GnuPG FP : 11AC BA4F 4778 E3F6 E4ED F38E B27B 944E 3488 4E85

2 1

[Bug 83] New: sql (oracle) queries dont escape single quotes
by bugzilla＠bugzilla.balabit.com 03 Jun '10

03 Jun '10

https://bugzilla.balabit.com/show_bug.cgi?id=83 Summary: sql (oracle) queries dont escape single quotes Product: syslog-ng Version: 3.1.x Platform: Other OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.syslogng(a)feystorm.net Type of the Report: --- Estimated Hours: 0.0 SQL inserts with values containing single quotes dont escape the quotes causing the inserts to fail. Jun 1 22:08:24 slider syslog-ng.515[20417]: Error running SQL query; type='oracle', host='', port='', user='report_agent', database='oru23', error='1400: ORA-01400: cannot insert NULL into ("CMS_DBO"."MESSAGE_TRACKING"."MSGID")\x0a', query='INSERT INTO cms_dbo.message_tracking (host, msg_dt, pname, message, msgid, xid, from_name, from_domain, to_name, to_domain, addr) VALUES (\'iceman.dev.usa.net\', \'2010-06-01 22:08:22\', \'smtad\', \'[4155186080] 000000007 ok XID: XID007oFawiw8111Xem MsgID: <4C0584D4.50007(a)devo0402.dev.usa.net> Dest: cms:gwsin IP: 165.212.101.13 From: <phemmer(a)devo0402.dev.usa.net> Rcpt: <phemmer(a)devo0402.dev.usa.net> Subject: \'\'Re: asdf\'\' Size: 22400 Response: 250 Mail accepted (292oFawiw3072Mem)\', NULL, \'XID007oFawiw8111Xem\', \'phemmer\', \'devo0402.dev.usa.net\', \'phemmer\', \'devo0402.dev.usa.net\', \'165.212.101.13\')' The part that is causing the problem is the 'message' field with value: [4155186080] 000000007 ok XID: XID007oFawiw8111Xem MsgID: <4C0584D4.50007(a)devo0402.dev.usa.net> Dest: cms:gwsin IP: 165.212.101.13 From: <phemmer(a)devo0402.dev.usa.net> Rcpt: <phemmer(a)devo0402.dev.usa.net> Subject: ''Re: asdf'' Size: 22400 Response: 250 Mail accepted (292oFawiw3072Mem) ^^that is what is passed in the insert statement. As you can see, there are 2 single-quotes around the subject. The string as it gets passed to syslog-ng is: ...Subject: 'Re: asdf' Size... So instead of escaping the single quote, it adds another quote. The afsql.c code calls dbi_conn_quote_string_copy to escape it, but this is obviously failing to do so (and not only fails, but for some reason adds a second quote. I'm attempting to find a simple fix for this, but there doesnt appear to be a clean & proper way of doing this. But I'll keep digging as this is a fairly significant flaw which I have to get fixed before using this in production. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

syslog-ng
by Kaushal Shriyan 03 Jun '10

03 Jun '10

Hi, Whats the message size a syslog-ng application can accommodate ? Thanks, Kaushal

2 1

log smtp mail messages to a specific file
by Thanasis 02 Jun '10

02 Jun '10

Postfix messages were logged in /var/log/messages. Here is how syslog-ng.conf was (before my changes): ---------------------------------------------------- # cat /etc/syslog-ng/syslog-ng.conf.orig @version: 3.0 # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo.3,v 1.1 2010/04/06 02:11:35 mr_bones_ Exp $ # # Syslog-ng default configuration file for Gentoo Linux options { chain_hostnames(no); # The default action of syslog-ng is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats_freq(43200); }; source src { unix-stream("/dev/log" max-connections(256)); internal(); file("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; # By default messages are logged to tty12... destination console_all { file("/dev/tty12"); }; # ...if you intend to use /dev/console for programs like xconsole # you can comment out the destination line above that references /dev/tty12 # and uncomment the line below. #destination console_all { file("/dev/console"); }; log { source(src); destination(messages); }; log { source(src); destination(console_all); }; ------------------------------------------------- I wanted to log postfix messages to a new file: /var/log/mail.log I changed /etc/syslog-ng/syslog-ng.conf like so: # diff syslog-ng.conf.orig syslog-ng.conf 15a16,23 > filter mail { > facility(mail); > }; > > filter notmail { > not facility(mail); > }; > 22a31 > destination mail { file("/var/log/mail.log"); }; 31,32c40,42 < log { source(src); destination(messages); }; < log { source(src); destination(console_all); }; --- > log { source(src); filter(mail); destination(mail); }; > log { source(src); filter(notmail); destination(messages); }; > log { source(src); filter(notmail); destination(console_all); }; ---------------------------------------------------------------------- It worked, or at least I think so, by looking at both /var/log/messages and /var/log/mail.log. So ,my questions are: 1) Are my edits OK? Did I do anything wrong? 2) Should I have configured it otherwise, perhaps more efficiently? Thanks. Thanasis

3 4

Re: [syslog-ng] Help
by Chaitanya Sangawar 28 May '10

28 May '10

I tried to use init.d script from a rpm version on solaris but for some reason it doesn't execute as is n I can't get it started as daemon. When I run syslog-ng, it works one time. I will go through the site also. Where can I get pre compiled version aren't they vad only for a month? Thanks, Chaitanya S Sent from HTC ________________________________ From: Patrick H. <syslogng(a)feystorm.net> Sent: Thursday, 27 May 2010 1:15 AM To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Help I loathe compiling on solaris, and try to avoid it wherever possible. If the only reason youre not using the pre-compiled package is the lack of init script, then it'd be easier to get an init script than compile a new syslog-ng. If anything, you can just yank the init script from the source and use it with the pre-compiled version. If youre using solaris 10, then the proper way is to use the SMF manifests. A good source is http://hub.opensolaris.org/bin/view/Community+Group+smf/manifests and there's one for syslog-ng listed there. Sent: Wednesday, May 26, 2010 1:30:25 PM From: Chaitanya Sangawar <CS0048029(a)TechMahindra.com><mailto:CS0048029@TechMahindra.com> To: syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu> <syslog-ng(a)lists.balabit.hu><mailto:syslog-ng@lists.balabit.hu> Subject: [syslog-ng] Help Hello All, I am not sure if this is a forum where I can post some help I would require but would appreciate if it is. I have been trying to install syslog-ng open source on Solaris since quite sometime and now I am almost giving up. After installing I would have presumed to have /etc/init.d/syslog-ng file created but it wasn’t. Also now I am not able to do “make” to syslog-ng , observing the following error. Can anyone help me why this is happening? Is it related to PATH / PKG_CONFIG_PATH or something ? Something or the other is happening and always ending up not able to complete the installation. # echo $PATH /usr/bin:/usr/sbin:/usr/ccs/bin:/usr/sbin:/usr/bin:/usr/bin:/usr/sbin:/opt/local/bin:/usr/local/bin:/opt/local/scripts/common:/usr/dt/bin:/usr/openwin/bin:/usr/ucb:/usr/bin/nsr:/usr/sbin/nsr:/usr/ccs/bin:/usr/local/bin:/usr/sfw/bin:/usr/lib:/usr/lib:/usr/local/lib:/usr/local/bin:/usr/sfw/bin:/usr/sfw/bin echo $PKG_CONFIG_PATH /usr/local/lib/pkgconfig/:/usr/lib/pkgconfig/:/usr/sfw/bin make make all-recursive Making all in src lex cfg-lex.l "cfg-lex.l":line 263: Error: missing translation value *** Error code 1 make: Fatal error: Command failed for target `cfg-lex.c' Current working directory /opt/syslog-ng-3.0.4/src *** Error code 1 The following command caused the error: failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src tests doc contrib debian tgz2build'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /opt/syslog-ng-3.0.4 *** Error code 1 make: Fatal error: Command failed for target `all' ============================================================================================================================Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at http://www.techmahindra.com/Disclaimer.html externally and http://tim.techmahindra.com/Disclaimer.html internally within Tech Mahindra.============================================================================================================================ ________________________________ ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html ============================================================================================================================Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra.============================================================================================================================

2 4

Help
by Chaitanya Sangawar 26 May '10

26 May '10

Hello All, I am not sure if this is a forum where I can post some help I would require but would appreciate if it is. I have been trying to install syslog-ng open source on Solaris since quite sometime and now I am almost giving up. After installing I would have presumed to have /etc/init.d/syslog-ng file created but it wasn't. Also now I am not able to do "make" to syslog-ng , observing the following error. Can anyone help me why this is happening? Is it related to PATH / PKG_CONFIG_PATH or something ? Something or the other is happening and always ending up not able to complete the installation. # echo $PATH /usr/bin:/usr/sbin:/usr/ccs/bin:/usr/sbin:/usr/bin:/usr/bin:/usr/sbin:/opt/local/bin:/usr/local/bin:/opt/local/scripts/common:/usr/dt/bin:/usr/openwin/bin:/usr/ucb:/usr/bin/nsr:/usr/sbin/nsr:/usr/ccs/bin:/usr/local/bin:/usr/sfw/bin:/usr/lib:/usr/lib:/usr/local/lib:/usr/local/bin:/usr/sfw/bin:/usr/sfw/bin echo $PKG_CONFIG_PATH /usr/local/lib/pkgconfig/:/usr/lib/pkgconfig/:/usr/sfw/bin make make all-recursive Making all in src lex cfg-lex.l "cfg-lex.l":line 263: Error: missing translation value *** Error code 1 make: Fatal error: Command failed for target `cfg-lex.c' Current working directory /opt/syslog-ng-3.0.4/src *** Error code 1 The following command caused the error: failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src tests doc contrib debian tgz2build'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /opt/syslog-ng-3.0.4 *** Error code 1 make: Fatal error: Command failed for target `all' ============================================================================================================================Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra.============================================================================================================================

2 1

Re: [syslog-ng] Program destination seems to block
by Evan Rempel 17 May '10

17 May '10

OK, I finally got back to this. The strace is too large to send to this list, approx 1MB. I'm not an strace expert, but it looks like the source is polled, but once the output can not be written to, the source is no longer read, even though the poll shows data is available. 14:56:42.508034 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508067 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508099 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508133 poll([{fd=4, events=POLLIN}, {fd=5, events=0}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 4, 304) = 1 ([{fd=3, revents=POLLIN}]) <0.000005> 14:56:42.508180 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000005> 14:56:42.508214 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508246 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000005> 14:56:42.508279 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508311 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000005> 14:56:42.508344 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508376 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508416 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000005> 14:56:42.508449 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508481 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000005> 14:56:42.508514 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508546 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508579 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> This just repeats over and over again. Thanks for looking at this. Balazs Scheidler wrote: > On Wed, 2010-04-14 at 14:04 -0700, Evan Rempel wrote: >> Balazs Scheidler wrote: >>> On Wed, 2010-04-14 at 13:18 -0700, Evan Rempel wrote: >>>> A little background. >>>> >>>> There is a "server" syslog-ng process that accepts messages from the network and >>>> sends the messages to a variety of destinations. For this report, I am only interested >>>> in one destination that happens to be a pipe. >>>> >>>> There is a "slave" syslog-ng process that reads from the pipe that the "server" writes to, >>>> and writes to a program destination. >>>> >>>> The program reads the standard in, and does "something". >>>> All works well. >>>> >>>> At some point our application (we know why and don't want to discuss it) application stops >>>> reading standard in for a while (1,000,000 lines over an hour). We expect that the memory >>>> footprint of syslog-ng "slave" to grow during this time but it does not. Instead, the >>>> memory footprint of the syslog-ng "server" grows. When our application starts reading >>>> its standard in again, the memory footprint of the syslog "slave" grows very quickly, >>>> and all messages reach the destination. >>>> >>>> I think that the syslog-ng "slave" get blocked on the program destination in a way that >>>> prevents it from reading its source, resulting in the upstream syslog-ng "server" having >>>> to buffer all of the messages. >>>> >>>> There is no flow control anywhere, and both syslog-ng instances have log_fifo_size(8000000) >>>> for all of the destinations. >>>> >>>> Anyone have any suggestions? >>> Hmm, either the slave syslog-ng really blocks (but I don't know any >>> similar bugs right now), or flow control is enabled. >>> >>> There was a bug that caused flow-control to be enabled, if any of the >>> flags was used. Do you have fallback enabled? >> No, the only flags in the "slave" is no-parse. >> >> >>> Can you post the exact versions of syslog-ng you are using? >> 3.0.5 OSE >> >> >>> Also, you could confirm if the slave instance really blocks, or it has >>> just stalled one of its sources. You could do that by attaching to the >>> slave process using strace for a little while. >>> >>> 1) first check what fd is being used between master/slave (lsof -p >>> <pid>) >>> 2) then check via strace if that fd is being polled for POLLIN or not >>> >>> If it is not polled, then flow-control is somehow enabled, if syslog-ng >>> is not polling but waiting somewhere, then it might be blocked as you >>> suggest. >>> >>> Anyway, the list of open file descriptors and the strace dump could help >>> in tracking down both cases. >> >> Not to be lazy here, but I am not going to get to this for weeks, really busy >> at my site right now. >> >> Here is a program that can turn on/off the reading of standard in by using >> kill -USR1 <PID> >> kill -USR2 <PID> >> >> >> --------------- >> #!/usr/bin/perl >> >> my $read = 0; >> >> $SIG{USR1} = sub { $read = 1 }; >> $SIG{USR2} = sub { $read = 0 }; >> >> while ( not eof(STDIN)) { >> if ( $read == 1 ) { >> $line = <STDIN>; >> print $line; >> } else { >> sleep 1; >> } >> } >> --------------- >> >> So hopefully you can reproduce this this really easy at your end. >> >> If I don't hear back, in a few weeks I'll get to this. > > I've tried it with 3.1.1, 3.0.6 and finally 3.0.5 and all behaved > properly. Memory size grew until it couldn't write to the test program, > of course only until the FIFO size filled up. > > Once I let the program go with a SIGUSR1 it started sending messages, > the drop count stayed the same. Flow-control was not enabled. > > -- Evan Rempel erempel(a)uvic.ca Senior Systems Administrator 250.721.7691 Unix Services, University Systems, University of Victoria -- Evan Rempel erempel(a)uvic.ca Senior Systems Administrator 250.721.7691 Unix Services, University Systems, University of Victoria

1 0

syslog file is empty
by Андрей 16 May '10

16 May '10

I'm using syslog-ng to collect logs from different devices and everything is Ok - all log files and directories are created and being written, except syslog log files - they are just empty (e.g. /var/log/hostname/syslog size is zero). Here is my config: monitoring:~# cat /etc/syslog-ng/syslog-ng.conf @version: 3.0 # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. Originally written by anonymous (I can't find his name) # Revised, and rewrited by me (SZALAY Attila <sasa(a)debian.org>) # First, set some global options. options { long_hostnames(off); flush_lines(0); use_dns(persist_only); dns_cache_hosts(/etc/hosts); use_fqdn(no); owner("root"); group("adm"); perm(0655); keep_hostname(yes); }; ######################## # Sources ######################## # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # source s_src { unix-dgram("/dev/log"); internal(); file("/proc/kmsg" program_override("kernel")); udp(ip(192.168.10.2) port(514)); }; # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # #source s_net { tcp(ip(127.0.0.1) port(1000) authentication(required) encrypt(allow)); }; ######################## # Destinations ######################## # First some standard logfile # destination d_auth { file("/var/log/$HOST/auth.log" suppress(15)); }; destination d_cron { file("/var/log/$HOST/cron.log" suppress(15)); }; destination d_daemon { file("/var/log/$HOST/daemon.log" suppress(15)); }; destination d_kern { file("/var/log/$HOST/kern.log" suppress(15)); }; destination d_lpr { file("/var/log/$HOST/lpr.log" suppress(15)); }; destination d_mail { file("/var/log/$HOST/mail.log" suppress(15)); }; destination d_syslog { file("/var/$HOST/log/syslog" suppress(15)); }; destination d_user { file("/var/log/$HOST/user.log" suppress(15)); }; destination d_uucp { file("/var/log/$HOST/uucp.log" suppress(15)); }; destination d_radius { file("/var/log/$HOST/radius.log" suppress(15)); }; # This files are the log come from the mail subsystem. # destination d_mailinfo { file("/var/log/$HOST/mail/mail.info" suppress(15)); }; destination d_mailwarn { file("/var/log/$HOST/mail/mail.warn" suppress(15)); }; destination d_mailerr { file("/var/log/$HOST/mail/mail.err" suppress(15)); }; # Logging for INN news system # destination d_newscrit { file("/var/log/$HOST/news/news.crit" suppress(15)); }; destination d_newserr { file("/var/log/$HOST/news/news.err" suppress(15)); }; destination d_newsnotice { file("/var/$HOST/log/news/news.notice" suppress(15)); }; # Some `catch-all' logfiles. # destination d_debug { file("/var/log/$HOST/debug" suppress(15)); }; destination d_error { file("/var/log/$HOST/error" suppress(15)); }; # The root's console. # #destination d_console { usertty("root");}; # Virtual console. # #destination d_console_all { file("/dev/tty10"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination d_xconsole { pipe("/dev/xconsole"); }; # Send the messages to an other host # #destination d_net { tcp("127.0.0.1" port(1000) authentication(on) encrypt(on) log_fifo_size(1000)); }; # Debian only #destination d_ppp { file("/var/log/ppp.log"); }; ######################## # Filters ######################## # Here's come the filter options. With this rules, we can set which # message go where. filter f_dbg { level(debug); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_err { level(err); }; filter f_crit { level(crit .. emerg); }; filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; filter f_error { level(err .. emerg) ; }; filter f_auth { facility(auth, authpriv) and not filter(f_debug); }; filter f_cron { facility(cron) and not filter(f_debug); }; filter f_daemon { facility(daemon) and not filter(f_debug); }; filter f_kern { facility(kern) and not filter(f_debug); }; filter f_lpr { facility(lpr) and not filter(f_debug); }; filter f_local { facility(local0, local1, local3, local4, local5, local6, local7) and not filter(f_debug); }; filter f_mail { facility(mail) and not filter(f_debug); }; filter f_news { facility(news) and not filter(f_debug); }; filter f_syslog3 { facility(syslog) and not filter(f_debug); }; filter f_user { facility(user) and not filter(f_debug); }; filter f_uucp { facility(uucp) and not filter(f_debug); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; #filter f_ppp { facility(local2) and not filter(f_debug); }; filter f_radius { facility(local1) and not filter(f_debug); }; #filter f_console { level(warn .. emerg); }; ######################## # Log paths ######################## log { source(s_src); filter(f_auth); destination(d_auth); }; log { source(s_src); filter(f_cron); destination(d_cron); }; log { source(s_src); filter(f_daemon); destination(d_daemon); }; log { source(s_src); filter(f_kern); destination(d_kern); }; log { source(s_src); filter(f_lpr); destination(d_lpr); }; log { source(s_src); filter(f_syslog3); destination(d_syslog); }; log { source(s_src); filter(f_user); destination(d_user); }; log { source(s_src); filter(f_uucp); destination(d_uucp); }; log { source(s_src); filter(f_radius); destination(d_radius); }; log { source(s_src); filter(f_mail); destination(d_mail); }; #log { source(s_src); filter(f_mail); filter(f_info); destination(d_mailinfo); }; #log { source(s_src); filter(f_mail); filter(f_warn); destination(d_mailwarn); }; #log { source(s_src); filter(f_mail); filter(f_err); destination(d_mailerr); }; log { source(s_src); filter(f_news); filter(f_crit); destination(d_newscrit); }; log { source(s_src); filter(f_news); filter(f_err); destination(d_newserr); }; log { source(s_src); filter(f_news); filter(f_notice); destination(d_newsnotice); }; #log { source(s_src); filter(f_cnews); destination(d_console_all); }; #log { source(s_src); filter(f_cother); destination(d_console_all); }; #log { source(s_src); filter(f_ppp); destination(d_ppp); }; log { source(s_src); filter(f_debug); destination(d_debug); }; log { source(s_src); filter(f_error); destination(d_error); }; #log { source(s_src); filter(f_console); destination(d_console_all); # destination(d_xconsole); }; #log { source(s_src); filter(f_crit); destination(d_console); }; # All messages send to a remote site # #log { source(s_src); destination(d_net); }; Everything seems to be Ok in config, what's wrong? Later I used 2.x version of syslog-ng and everything worked. -- С уважением, Андрей.

3 2