- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Syslog-NG Premium Edition installation on SuSE Linux Enterprise Server 10
by Heinze, René 15 Feb '10

15 Feb '10

>On Mon, Feb 15, 2010 at 05:05:21PM +0100, Balazs Scheidler wrote: >> On Mon, 2010-02-15 at 16:38 +0100, Heinze, René wrote: >> > Hello, >> > >> > I´m having trouble installing the Syslog-NG Premium Edition on SLES >> > 10. I´m installing the RPM package 3.04 x86 for OpenSuSE 10.1. The RPM >> > installes just fine, but I´m not able to run the .run installer. The >> > installation of the rpm package is completely unattended. How can I >> > start the .run installer? >> > >> >> That's right, the rpm package is not interactive. You can start the .run >> installer by removing the .rpm package first and starting the .run file >> as a command: >> >> # ./syslog-ng-premium-edition-3.0.4-linux-i386.run >Please make sure, that the .run file has the executable attribute set >before you attempt to run it: > ># chmod +x syslog-ng-premium-edition-3.0.4-linux-i386.run ># ./syslog-ng-premium-edition-3.0.4-linux-i386.run > >or force the shell to execute it: > ># sh syslog-ng-premium-edition-3.0.4-linux-i386.run Thanks for you support! I have overlooked the generic linux version on the Balabit webpage. What´s the best method installing Syslog-NG Premium on a SLES 10 System, generic or the rpm version? On the rpm version, how do i attach the license file? If the rpm version is not interactive then there is a error in the admin manual. The manual says on page 86 in the first line: "Answer the configuration questions of syslog-ng. These are described in detail in Section 4.1, “Installing syslogng using the .run installer” (p. 78)." Best Regards, René H. Besuchen Sie die Bundesdruckerei auf der CeBIT 2010 vom 2.-6.3.2010, Halle 9, Stand D80 Visit Bundesdruckerei at CeBIT, exhibition centre, hall 9 / stand D80 weitere Informationen unter: http://www.bundesdruckerei.de/de/unternehmen/untern_cebit2010/index.html find more information here http://www.bundesdruckerei.de/en/company/comp_cebit2010/index.html

1 0

Syslog-NG Premium Edition installation on SuSE Linux Enterprise Server 10
by Heinze, René 15 Feb '10

15 Feb '10

Hello, I´m having trouble installing the Syslog-NG Premium Edition on SLES 10. I´m installing the RPM package 3.04 x86 for OpenSuSE 10.1. The RPM installes just fine, but I´m not able to run the .run installer. The installation of the rpm package is completely unattended. How can I start the .run installer? Thanks! Best Regards, René Heinze ________________________________ Besuchen Sie die Bundesdruckerei auf der CeBIT 2010 vom 2.-6.3.2010, Halle 9, Stand D80 Visit Bundesdruckerei at CeBIT, exhibition centre, hall 9 / stand D80 weitere Informationen unter: http://www.bundesdruckerei.de/de/unternehmen/untern_cebit2010/index.html find more information here http://www.bundesdruckerei.de/en/company/comp_cebit2010/index.html

3 2

Getting a SQL insert to match what's being written to file
by Jeremy M. Guthrie 15 Feb '10

15 Feb '10

I have an issue where what is being written to file is different than what I have being written to disk. I don't know if the macro is broken, my understanding is wrong, or I am just using the wrong macro altogether. My understanding is roughly as follows: PROGRAM The name of the program sending the message. PID The PID of the program sending the message. MSG or MESSAGE Message contents including the program name and pid. MSGONLY Message contents without the program name. 1. The first thing I ran into: Example messages on file: Jan 25 08:34:15 XXXXXXXXXX sshd[7209]: service name is :: sshd Same example message in SQL: Jan 25 08:34:15 XXXXXXXXXX service name is :: sshd template("INSERT INTO tsyslog (host, facility, severity, date, time, message) VALUES ( '$HOST','$FACILITY_NUM','$LEVEL_NUM','$YEAR-$MONTH-$DAY','$HOUR:$MIN: $SEC', '$MSG');\n" ) 2. Then what I tried to get it closer.... Example messages on file: Jan 25 08:40:18 XXXXXXXXXX sshd[7209]: service name is :: sshd Same example message in SQL: Jan 25 08:40:18 XXXXXXXXXX sshd: service name is :: sshd template("INSERT INTO tsyslog (host, facility, severity, date, time, message) VALUES ( '$HOST','$FACILITY_NUM','$LEVEL_NUM','$YEAR-$MONTH-$DAY','$HOUR:$MIN: $SEC', '$PROGRAM: $MSG');\n" ) 3. Then what I tried to get even closer: Example messages on file: Jan 25 08:53:15 XXXXXXXXXX sshd[7209]: service name is :: sshd Same example message in SQL: Jan 25 08:53:15 XXXXXXXXXX sshd[7209]: service name is :: sshd template("INSERT INTO tsyslog (host, facility, severity, date, time, message) VALUES ( '$HOST','$FACILITY_NUM','$LEVEL_NUM','$YEAR-$MONTH-$DAY','$HOUR:$MIN: $SEC', '$PROGRAM[$PID]: $MSG');\n" ) However, this broke messages coming from Cisco devices... Jan 25 08:55:10 FIREWALL %FWSM-3-710003[]: tcp access denied by ACL from 188.23.180.240/3826 to outside:172.26.54.65/445 The message above should be: Jan 25 08:55:10 FIREWALL %FWSM-3-710003: tcp access denied by ACL from 188.23.180.240/3826 to outside:172.26.54.65/445 Notice the above '[]' after the FWSM code? I am running 3.0.5 syslog-ng. Ideally I'd get both: Jan 25 08:55:10 FIREWALL %FWSM-3-710003: tcp access denied by ACL from 188.23.180.240/3826 to outside:172.26.54.65/445 AND Jan 25 08:53:15 XXXXXXXXXX sshd[7209]: service name is :: sshd Is the MSG/MESSAGE macro broken? What am I missing? -- -------------------------------------------------- Jeremy M. Guthrie jeremy.guthrie(a)cdw.com Managed Cisco Security Services Hosting and Managed Services Technical Architect Phone: 608-298-1061 CDW Fax: 608-288-3007 5520 Research Park Drive NOC: 608-298-1102 Madison, WI 53711 NOC Email: hmshelp(a)cdw.com

2 2

Syslog restarting
by Henric Larsson 11 Feb '10

11 Feb '10

Hi, We're using syslog-ng PE with disk buffering enabled. The syslog clients gets disconnected all the time, and when they restart I get these log messages: 2010-02-11T14:19:37+00:00 bruatosd003 syslog-ng[4686]: I/O error occurred while writing; fd='8', error='Connection reset by peer (104)' 2010-02-11T14:19:37+00:00 bruatosd003 syslog-ng[4686]: Syslog connection broken; fd='8', server='AF_INET(172.27.12.22:1998)', time_reopen='60' 2010-02-11T14:19:37+00:00 bruatosd003 syslog-ng[4686]: Closing log transport fd; fd='8' 2010-02-11T14:20:41+00:00 bruatosd003 syslog-ng[4686]: Syslog connection established; fd='8', server='AF_INET(172.27.12.22:1998)', local='AF_INET(0.0.0.0:0)' 2010-02-11T14:20:54+00:00 bruatosd003 syslog-ng[28626]: The current log file has a mismatching size/inode information, restarting from the beginning; filename='/var/ig/logs/orderserver/os-gc.1.log' 2010-02-11T14:20:54+00:00 bruatosd003 syslog-ng[28626]: Disk-buffer state saved; filename='/var/ig/logs/orderserver/syslog-ng-db/syslog-ng-00004.qf', qout_length='0', qbacklog_length='0', qoverflow_length='0', qdisk_length='0' 2010-02-11T14:20:54+00:00 bruatosd003 syslog-ng[28626]: The current log file has a mismatching size/inode information, restarting from the beginning; filename='/var/ig/logs/orderserver/os-gc.2.log' After that syslog starts to send the contents of the file from the start of the file again, after a while it restart this process. In a seemingly endless loop. As you can see the pid changes between the disconnect and the message about mismatching size/inode. I'm trying to work out what causes it and how to fix it, any suggestions? Best, Henric ________________________________ The information contained in this email is strictly confidential and for the use of the addressee only, unless otherwise indicated. If you are not the intended recipient, please do not read, copy, use or disclose to others this message or any attachment. Please also notify the sender by replying to this email or by telephone (+44 (0)20 7896 0011) and then delete the email and any copies of it. Opinions, conclusions (etc.) that do not relate to the official business of this company shall be understood as neither given nor endorsed by it. IG Index Ltd is a company registered in England and Wales under number 01190902. VAT registration number 761 2978 07. Registered Office: Friars House, 157-168 Blackfriars Road, London SE1 8EZ. Authorised and regulated by the Financial Services Authority. FSA Register number 114059.

1 0

[Re: handling errors with sql inserts]
by Juhasz Viktor 11 Feb '10

11 Feb '10

1 0

handling errors with sql inserts
by Bob Belnap 10 Feb '10

10 Feb '10

Hello, I am parsing some of my log messages into different database columns using the sql() function, and I have noticed that when there is an insert error into the database no further logs for that host make it to the db. In fact, syslog-ng keeps attempting the insert, and logs the insert error indefinitely. I couldn't find a way to gracefully handle these sorts of errors in the docs. I'd like to be able to specify an action on a database insert failure (log message to a different log and stop trying to insert, for example). But I do not want a single insert failure to stop all subsequent inserts for that host. What are my options here? I'm currently using OSE 3.0.4. Thanks for your help. --Bob

2 2

Re: [syslog-ng] need help with a match filter
by chris packham 10 Feb '10

10 Feb '10

Someone else on the list may correct me but I think you'll find that the destination is evaluated at the time syslog is started (or restarted) not when a log message is processed. I'm pretty sure there was a discussion on the list about something similar a while back (although I couldn't find it in my emails) So short answer is that you can't use a file desination. You may however get some mileage out of writing a custom program destination and do the last bit of processing in your program. >>> Rory Toma <rory(a)ooma.com> 01/25/10 5:12 PM >>> Looking more at the docs, it looks likes I also need a value for 3.0 syntax. So I am trying something like below. However, the value of $foo_hostdir is not being set correctly. It is being set to "foo_hostdir". How do I get the value to be the value of the match? filter foo_filter { match('host("foo_[0-9A-F]\{9\}$")' value("foo_hostdir") type("string") ); }; # foo destinations destination foo_dest { file("/logs/$foo_hostdir/$R_YEAR$R_MONTH$R_DAY/$HOST-$R_YEAR$R_MONTH$R_DAY.log" owner(root) group(root) perm(0444) template("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC $MSG\n") template_escape(no)); }; On 1/25/10 12:02 PM, Rory Toma wrote: > I'm trying to dynamically create lognames and directories form the host > name that is sent. My hosts' names are of the form > > foo_<mac address> > > I want to create a destination that would be > > /logs/foo_<first 9 digits of mac address>//foo_.log > > Here is what I tried so far, and it does not work, but is close. Can > someone suggest a config that might work? Thx. > > I can do this individually, but having 100+ filters and 100+ log lines > in the config really slows things down. > > #filter for foo > filter foo_filter { match('host("foo_[0-9A-F]\{9\}$")' > flags("store-matches")); }; > > # foo destinations > destination foo_dest { > > file("/logs/$0/$R_YEAR$R_MONTH$R_DAY/$HOST-$R_YEAR$R_MONTH$R_DAY.log" > owner(root) group(root) perm(0444) > template("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC $MSG\n") > template_escape(no)); > }; > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

3 7

--fd-limit
by Rory Toma 10 Feb '10

10 Feb '10

My understanding (now) is that you need to set --fd-limit *and* up the ulimit. Simply updating ulimit is not sufficient for syslog-ng to be able to handle more than the default 4k open files. Is this correct?

2 1

Apache + syslog-ng w/o logger?
by Brian Donaldson 09 Feb '10

09 Feb '10

My goal is to enable Apache to log large access_log entries (> 1024 chars) to a syslog-ng server. The vast majority of examples I've seen for connecting Apache to syslog-ng employ the ancient /usr/bin/logger -- but that approach chops up messages longer than 1024 chars. The alternative approach is to use a perl/python script, but I'm nervous about the overhead. Anyone know of an updated logger binary? Thanks for any pointers, -Brian

5 4

two sources one udp address
by Alexei Shilin 06 Feb '10

06 Feb '10

Hi! I have source src { unix-stream("/dev/log" max-connections(512)); internal(); file("/proc/kmsg"); udp(port(514)); }; ... source temp { udp(port(514)); }; and then I have to log rules: one for src and one for temp, no flags are set. Will those two sources play nice with each other and will not interfer? E.g. if one reads from that port, will the log message that was read by the first available for read by the second? -- http://www.fastmail.fm - Email service worth paying for. Try it for free

2 1