- syslog-ng - lists.balabit.hu

[Bug 81] New: feature request: nested source statements
by bugzilla＠bugzilla.balabit.com 06 May '10

06 May '10

https://bugzilla.balabit.com/show_bug.cgi?id=81 Summary: feature request: nested source statements Product: syslog-ng Version: 3.0.x Platform: Other OS/Version: FreeBSD Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jschauma(a)netmeister.org Type of the Report: --- Estimated Hours: 0.0 Ie, I have source s_tcp6 { tcp6(log_fetch_limit(25) port(601)); } source s_tcp4 { tcp(log_fetch_limit(25) port(601)); }; and I would like to have another source s_tcp { s_tcp4; s_tcp6; }; but no matter what I try, I get syntax errors. Is it not possible to have nested/derived source statements? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Questions regarding Syslog-ng
by Dyne Lai 05 May '10

05 May '10

Dear Syslog-ng developers, I am very interested and impressed with the many features of Syslog-ng as compared to Syslogd and would consider implement it in my servers. However, I do have some questions regarding Syslog-ng that I would like to enquiry as below. 1) Is it possible for both Syslogd and Syslog-ng to co-exist and run concurrently in a single server? The rational for this question is due to support reason and security reason that will require the presence of Syslogd even though it can be replaced by Syslog-ng. Thank you for the time! Best Regards, Dyne Lai

2 1

error in documentation
by Patrick H. 04 May '10

04 May '10

Found another error in the documentation (version 3.1). The docs list "stats_reset" as a valid config option, yet trying to use it results in a syntax error on start, and cfg-lex.l in the source has nothing about it. Guessing this was removed and the docs never got updated.

2 1

Re: [syslog-ng] log_disk_fifo_size() option available in syslog-ng 3.1.1 ?
by Ilas, Yann 03 May '10

03 May '10

Thank you for that fast answer. I'm so sad now :-( As I found an error into the doc, did I win a license of the "Premium Edition" ? :-) ...Joke :-) Regards, Yann > Hi, > > disk-based buffering is currently not available in the Open Source Edition, only > in the Premium Edition, but it seems that the description of the option has > accidentally remained in the OSE admin guide. > > Thank you for noticing it, and my apologies for the mistake. > I will remove it from the docs and update it on the web. > > Regards, > > Robert > > Ilas, Yann wrote: > >> Hello, >> >> I tried to use the disk-based buffering as described in the document "The >> syslog-ng Open Source Edition 3.1 Administrator.pdf" but I have a syntax >> error when I start the process. >> I used this configuration for the destination part of my configuration file >> : >> destination d_tcp { >> tcp("10.1.2.3" port(1999) log_disk_fifo_size(4194304)); }; >> >> When I remove "log_disk_fifo_size" of my configuration, everything is OK and >> syslog-ng doesn't complain. >> Did I miss something ? >> >> Regards, >> >> Yann >> >> >> >> >> ------------------------------------------------------------------------ >> >> ____________________________________________________________________________ __ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> >> FAQ: http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

log_disk_fifo_size() option available in syslog-ng 3.1.1 ?
by Ilas, Yann 03 May '10

03 May '10

Hello, I tried to use the disk-based buffering as described in the document "The syslog-ng Open Source Edition 3.1 Administrator.pdf" but I have a syntax error when I start the process. I used this configuration for the destination part of my configuration file : destination d_tcp { tcp("10.1.2.3" port(1999) log_disk_fifo_size(4194304)); }; When I remove "log_disk_fifo_size" of my configuration, everything is OK and syslog-ng doesn't complain. Did I miss something ? Regards, Yann

2 1

Syslog-ng Agent for Windows 3.1 " Customizing file messages"
by John MacDonald 28 Apr '10

28 Apr '10

I am trying to follow the following procedure: Procedure 3.18. Customizing file messages 1. Start the configuration interface of the syslog-ng Agent for Windows application. 2. Select syslog-ng Agent Settings, right-click on File Sources and select Properties. 3. Type the message format into the Message Template field. You can use date- and file-related macros (see Section 3.6.2, "Macros available in the syslog-ng Agent" (p. 26) for a list of macros). The message customized here is included in the server-specific templates using the MESSAGE macro. By default, the following is sent about file messages: $FILE_NAME: $FILE_MESSAGE. 4. Select Apply, then OK. To activate the changes, restart the syslog-ng Agent service. My issue is on File Sources>Properties there isn't a Message Template field. Can you tell me if there is another procedure for this? Thanks. John

2 1

syslig-ng Agent for Windows supported OS
by John MacDonald 27 Apr '10

27 Apr '10

Issue resolved I was running the run installer. John

1 0

syslig-ng Agent for Windows supported OS
by John MacDonald 27 Apr '10

27 Apr '10

I am trying to configure the Windows Syslog-Ng agent on Windows 2003 R2 and Windows 2008 Standard. The installer will run and a Service is installed, but I do not have any of the features or configuration options. Can you tell me if the Operating Systems listed above are supported? I am using version syslog-ng-agent-setup-3.1.0-amd64.msi Thanks. John

1 0

filter after source or indifferent?
by Giovanni Mancuso 27 Apr '10

27 Apr '10

Hi, i have a question about syslog-ng configuration. I configure my log path in this way: log { source(s_funambol); destination(d_network); filter(f_funambol); }; And it doesn't work. If i configure the log path in this way: log { source(s_funambol); filter(f_funambol); destination(d_network); }; It works. Is it normal? Is required that the filter goes after the source? Thanks

2 1

Re: [syslog-ng] Process stored logs
by noel anderson 26 Apr '10

26 Apr '10

Thanks patrick. This raises another question, how can I Quantify processed logs. Like what is been processed/ un-processed/ lost. Thanks, Noel (hsxtrt) Date: Thu, 22 Apr 2010 11:26:59 -0600 From: "Patrick H." <syslogng(a)feystorm.net> Subject: Re: [syslog-ng] Process stored logs To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <4BD086E3.3030200(a)feystorm.net> Content-Type: text/plain; charset="iso-8859-1" The log_fifo_size variable controls how many messages the output buffer will hold. So if server Z is relaying to A, and A goes down, Z will start storing messages in this buffer. Unfortunately there is no way to say 'if destination A fails, log to destination A2 (which may be a file output or something) instead'. The premium version does support disk-based buffering though, so that if log_fifo_size fills up, it'll start writing out to a disk based file instead. Sent: Thursday, April 22, 2010 12:13:40 AM From: noel anderson <nascentcatalyst(a)yahoo.com> To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Process stored logs > I'm building an infra across the geo's to collect logs at a central repository. I have set up syslog-ng in 3 geo's (say for e.g X, Y, Z) to collect logs form servers in respective Geo. A forurth server (say for eg. A) where the logs are forwarded from the 3 log servers to aggregate all the logs from all GEO's. > > The problem where I fail to understand is, if my aggregator server (A) goes down, how do i process my stored logs on (X,) (Y), (Z), so that i do not loose any logs during my downtime. > > Is it possible to process backlog of logs on the server or do i have to change my infra so that i do not loose these logs? > > Thanks > Noel (hsxtrt)

2 1