- syslog-ng - lists.balabit.hu

new blog about syslog-ng and software testing
by Zoltán Pallagi 17 Dec '09

17 Dec '09

Hi all, I would like you to know that I've created a new blog about syslog-ng, and software testing. http://pzolee.blogs.balabit.com I hope that you will find some useful and interesting informations here -- pzolee

1 0

Error in FreeBSD jail
by Peter Fraser 17 Dec '09

17 Dec '09

Hi All I installed syslog-ng3-3.0.3_3 in a jail, when I start the service, I get this error below Starting syslog_ng. Error binding socket; addr='AF_UNIX(/var/run/log)', error='Permission denied (13)' Error initializing source driver; source='src', id='src#0' Error initializing message pipeline; /usr/local/etc/rc.d/syslog-ng: WARNING: failed to start syslog_ng Does anyone have any ideas on what I could do to troubleshoot or resolve this problem? Thanks for any help.

2 5

supervise/syslog-ng exits
by Kārlis Repsons 17 Dec '09

17 Dec '09

People, I wonder why is there some two messages like this in errors log each day: supervise/syslog-ng[28806]: Daemon exited gracefully, not restarting; exitcode='0' ? What are the possible reasons and what should be done?

6 12

3.03 filtering problem
by Tim Boyer 16 Dec '09

16 Dec '09

OK, I assume that this is something stupid I'm doing - but I've started at the config file for a week, and I'll be darned if I can see it. I've got a fairly vanilla setup, and I'm trying to send dhcpd, snort, etc to separate filters, while at the same time keeping one file with all of the error messages. Like so: # # log sources # source server { file("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; destination dserver_all { file("/var/log/${HOST}.log" owner(root) group(hobbit) perm(0640)); }; destination dserver_cfengine { file("/var/log/cfengine.log"); }; destination dserver_snort { file("/var/log/snort.log"); }; destination dserver_dhcpd { file("/var/log/dhcpd.log"); }; ... filter fserver_snort { program("snort"); }; filter fserver_dhcpd { program("dhcpd"); }; filter fserver_cfengine { program("cfengine"); }; ... log { source(server); destination(dserver_all); }; log { source(server); filter(fserver_snort); destination(dserver_snort); flags(final); }; log { source(server); filter(fserver_cfengine); destination(dserver_cfengine); flags(final); }; log { source(server); filter(fserver_dhcpd); destination(dserver_dhcpd); flags(final); }; The 'log everything' is working fine. Some of the filtered logs are working fine, like the cfengine log: [root@saratoga log]# ls -la /var/log/cfengine.log -rw------- 1 root root 181006 Dec 14 11:15 /var/log/cfengine.log The dhcpd log is empty: [root@saratoga log]# ls -la /var/log/dhcpd.log -rw------- 1 root root 0 Dec 13 02:42 /var/log/dhcpd.log even though there are entries in the combined log that clearly should have hit the dhcpd log: [root@saratoga log]# tail /var/log/saratoga.log Dec 14 11:25:07 saratoga dhcpd: Copyright 2004-2006 Internet Systems Consortium. Dec 14 11:25:07 saratoga dhcpd: All rights reserved. Dec 14 11:25:07 saratoga dhcpd: For info, please visit http://www.isc.org/sw/dhcp/ Dec 14 11:25:07 saratoga dhcpd: Wrote 22 leases to leases file. Dec 14 11:25:07 saratoga dhcpd: Listening on LPF/eth3/00:0e:0c:6d:64:cf/192.168.3/24 What in the world am I missing? Thanks much, -- tim -- -- Tim Boyer Denman Tire Corporation

1 1

3.1 Beta 1 memory leak?
by Martin Holste 16 Dec '09

16 Dec '09

I'm trying the new 3.1 beta 1 build, and even with log_fifo_size(0), syslog-ng consumes all available memory until the kernel out-of-memory manager kills it. At first I thought this had something to do with UDP forwarding to a destination, but even with that disabled, the uncontrolled consumption occurs. I reconfigured with the most basic configuration to just dump everything to /dev/null, and though the leak is slower, the leak continues. Compiled with: Glibc-2.20.3 PCRE 7.9 syslog-ng 3.1beta1 Installer-Version: 3.1beta1 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#3412dce0235e8d65bc3bebedffe8ff6bed02f45b Compile-Date: Dec 11 2009 11:36:51 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on Configuration: @version: 3.0 options { ts_format(iso); stats_level(1); stats_freq(30); keep_hostname(no); chain_hostnames(yes); create_dirs(yes); }; source s_tcp { tcp(ip(0.0.0.0) port(514)); }; source s_udp { udp(ip(0.0.0.0) port(514)); }; destination d_null { file("/dev/null"); }; log { source(s_udp); source(s_tcp); destination(d_null); };

2 2

syslog-ng OSE 3.0.4 coredumps when use "internal()" in s_local
by nova club 15 Dec '09

15 Dec '09

Hi there, I am a new user of syslog-ng. Thanks for your time and attention in advance. The problem is syslog-ng coredumps when use "internal()" in "source", however it will work fine without "internal()". The conf file is like: ===>BEGIN @version:3.0 options { dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname(yes); }; # Default local source. source local { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; ... filter f_hecxd { program("hecxd"); }; ... log { source(local); filter(f_hecxd); destination(d_hecxd); }; ==>END The options used for building syslog-ng is: CFLAGS='-Wl,-Bdynamic -liconv -Wl,-Bstatic' --enable-static-linking \ --enable-debug \ --enable-ssl --enable-ipv6=no --enable-tcp-wrapper=no \ --with-pidfile-dir="/var/run/" The platform is: FREEBSD 6.4-RELEASE-p6 i386 I got a very big core dump file (>500M), by backtracing that file, I can see the problem is "g_malloc0" for some reason failed to allocate memory, while syslog-ng did not check the return value and tried to use the "0x0" pointer in a "strlen()" call later. Here is a part of trace information: #0 0x080a2d8d in strlen () No symbol table info available. #1 0x0804e7fe in log_msg_new_internal (prio=43, msg=0x0, flags=6) at logmsg.c:1971 buf = (gchar *) 0x0 self = (LogMessage *) 0x8159000 #2 0x080492b1 in msg_send_internal_message (prio=43, msg=0x0) at messages.c:128 context = (MsgContext *) 0x81893a0 m = (LogMessage *) 0x7 #3 0x0804954c in msg_log_func (log_domain=0x81186ea "GLib", log_flags=6, msg=0x0, user_data=0x0) at messages.c:187 pri = 43 #4 0x08084906 in IA__g_logv (log_domain=0x81186ea "GLib", log_level=G_LOG_LEVEL_ERROR, format=0x811cbac "%s: failed to allocate %u bytes", args1=0xbfbfe6cc "3�\021\bl") at gmessages.c:519 msg = (gchar *) 0x0 was_fatal = 0 was_recursion = 0 i = 2 #5 0x08084ae4 in IA__g_log (log_domain=0x81186ea "GLib", log_level=G_LOG_LEVEL_ERROR, format=0x811cbac "%s: failed to allocate %u bytes") at gmessages.c:569 No locals. #6 0x08084239 in IA__g_malloc0 (n_bytes=108) at gmem.c:155 mem = 0x0 #7 0x0804e5ef in log_msg_new ( msg=0x8a82180 "<47> syslog-ng[3277]: Filter node evaluation result; filter_result='not-match', filter_type='level'\n", length=100, saddr=0x0, flags=6, bad_hostname=0x0, assume_timezone=-1, default_pri=47) at logmsg.c:1873 self = (LogMessage *) 0x810ba1b #8 0x0804e80a in log_msg_new_internal (prio=47, msg=0x817f500 "Filter node evaluation result; filter_result='not-match', filter_type='level'", flags=6) at logmsg.c:1971 buf = (gchar *) 0x8a82180 "<47> syslog-ng[3277]: Filter node evaluation result; filter_result='not-match', filter_type='level'\n" self = (LogMessage *) 0x8159000 #9 0x080492b1 in msg_send_internal_message (prio=47, msg=0x817f500 "Filter node evaluation result; filter_result='not-match', filter_type='level'") at messages.c:128 context = (MsgContext *) 0x81893a0 m = (LogMessage *) 0x8182030 If you need the completed coredump file, just let me know and tell me where to put it :) Any help is much appreciated. Thanks a lot. Shen _________________________________________________________________ Windows Live: Make it easier for your friends to see what you’re up to on Facebook. http://go.microsoft.com/?linkid=9691816

2 4

Re: [syslog-ng] Syslog-NG 3.0.5 incorrectly parsing messages without program names
by Larry Low 15 Dec '09

15 Dec '09

> In the past I used the MSG macro to get the full syslog message. Now > MSG is broken into MSG and MSGHDR. > > If a message comes in without a program name such as "exiting on signal > 15" or "last message repeated 20 times", syslog-ng incorrectly takes > the first word as the program name. Trying to rebuild it with > $MSGHDR$MSG causes an erroneous : to be placed on these messages since > $MSGHDR is filled in with "exiting" and "last". I found a previous post and tried adding store-legacy-msghdr. The problem now is that MSGHDR still includes the first word such as "exiting" and "last" but no colon but on messages like "kernel : Kernel logging (proc) stopped.", "kernel: " is put in MSGHDR but then also placed in MSG and MSGONLY. > > --- > Larry Lo

2 7

Re: [syslog-ng] syntax error in config-file
by Pallagi Zoltán 15 Dec '09

15 Dec '09

andip írta: > Hi, > > You're right i got the syslog filter, but not destination. i changed that to > _syslog, and as i started syslog-ng again, i got syntax-errors on different > lines. i fixed the lines one after the other (see comments in config file in > original mail). the last error that i could not get past was on line 35, > which is the first filter-line in my config-file. > double quote is missing from filter: - filter aplog { host (10.20.); }; + filter aplog { host ("10.20."); }; > so since syslog-ng exited with syntax-error, and it reports it being line 35, > i felt sure it had to do with that line, though ofc i can be wrong as i'm an > amateur. i am ofc aware there are/might be errors further down in the > config-file. > i'd very much like to be certain though, before i re-install version 3.0.4 > again. > > could you please confirm for me that you're aware of this before i try out > your suggested solution? > There is my solution, it worked for me: @@ -28,8 +28,7 @@ destination ipflog { file ("/var/log/ipflog"); }; destination imaplog { file ("/var/log/imaplog"); }; destination console { file ("/dev/console"); }; -destination syslog { file ("/var/log/syslog"); }; ### changed -to _syslog +destination _syslog { file ("/var/log/syslog"); }; ### changedto _syslog destination komm { file ("/var/log/fwlogs/kommunikasjon-context.log"); }; destination asa { file ("/var/log/fwlogs/asa.log"); }; @@ -47,8 +46,7 @@ destination wifi { file ("/var/log/fwlogs/wifi-context.log"); }; destination aplog { file ("/var/log/aplog/aplog.txt"); }; -filter aplog { host (10.20.); }; ### this line caused the -syntax error (line 35) +filter aplog { host ("10.20."); }; filter gje { host (10.8.30.28); }; filter nes { host (10.8.30.20); }; filter ull { host (10.8.30.36); }; @@ -75,7 +73,7 @@ filter mail { facility (mail); }; filter daemon { facility (daemon); }; filter auth { facility (auth); }; -filter syslog { facility (syslog); }; +filter _syslog { facility (syslog); }; filter lpr { facility (lpr); }; filter news { facility (news); }; filter uucp { facility (uucp); }; @@ -103,7 +101,7 @@ log { source (sys); filter (mail); destination (maillog); }; #log { source (sys); filter (local0); destination (ipflog); }; #log { source (sys); filter (local1); destination (imaplog); }; -log { source (sys); filter (syslog); destination (syslog); }; +log { source (sys); filter (_syslog); destination (_syslog); }; log { source (sys); filter (emerg); filter (user_none); destination (console); }; log { source (sys); filter (mesg); filter (user_none); and of course you also have to check the warnings after starting. If everything is all right put "@version: 3.0" line on the top of your config. > cheers > andip > > ----- Original Message ----- > From: Pallagi Zoltán <pzolee(a)balabit.hu> > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu>, andip(a)syndig.com > Sent: Tue, 15 Dec 2009 10:43:10 +0100 > Subject: Re: [syslog-ng] syntax error in config-file > > >> Hi, >> >> In syslog-ng 3.0, "syslog" became a reserved word and you have a >> destination and a filter called "syslog" in your config. >> Please rename them and it will work >> >> andip írta: >> >>> Hi folks, >>> >>> I just tried updating syslog-ng to version 3.0.4, from 2.1.4. i use the >>> gentoo linux-distro, and the new version came into "stable" gentoo a few >>> >> days >> >>> ago. >>> >>> I'm no syslog-ng expert, but i use it to log quite a few things, so my >>> config-file it not default. >>> I've read a bit in the admin-guide, but did not find any reason to my >>> problem. >>> >>> i've tried converting my 2.1.4 config-file to the new 3.0.4 version, with >>> > > >> no >> >>> success. this is parts of my old config-file. ### are comments made to >>> reflect changes i made for v2 -> v3 conversion >>> >>> > ---------------------------------------------------------------------------- > >>> options { >>> chain_hostnames(off); ### changed this to "no" >>> sync(0); ### changed this to "flush_lines" >>> time_sleep(20); >>> log_fifo_size (2048); >>> create_dirs (yes); >>> perm (0640); >>> dir_perm (0750); >>> stats(43200); ### changed this to "stats_freq" >>> owner (syslogger); >>> group (syslogger); >>> perm (0664); >>> }; >>> >>> source sys { >>> unix-stream("/dev/log" max-connections(256)); >>> internal(); >>> file("/proc/kmsg"); >>> }; >>> >>> source net { udp(); }; >>> >>> destination clients { file ("/var/log/fwlogs/netclients/$HOST"); }; >>> destination console_all { file ("/dev/tty12"); }; >>> destination authlog { file ("/var/log/authlog"); }; >>> destination messages { file ("/var/log/messages"); }; >>> destination maillog { file ("/var/log/maillog"); }; >>> destination ipflog { file ("/var/log/ipflog"); }; >>> destination imaplog { file ("/var/log/imaplog"); }; >>> destination console { file ("/dev/console"); }; >>> destination syslog { file ("/var/log/syslog"); }; ### changed >>> >> to _syslog >> >>> >>> >>> destination komm { file ("/var/log/fwlogs/kommunikasjon-context.log"); >>> > > >>> }; >>> destination asa { file ("/var/log/fwlogs/asa.log"); }; >>> destination edb { file ("/var/log/fwlogs/edb-pix.log"); }; >>> destination gje { file ("/var/log/fwlogs/gjerdrum.log"); }; >>> destination nes { file ("/var/log/fwlogs/nes.log"); }; >>> destination ull { file ("/var/log/fwlogs/ullensaker.log"); }; >>> destination hur { file ("/var/log/fwlogs/hurdal.log"); }; >>> destination eid { file ("/var/log/fwlogs/eidsvoll.log"); }; >>> destination nan { file ("/var/log/fwlogs/nannestad.log"); }; >>> destination datas { file ("/var/log/fwlogs/datasenter-context.log"); }; >>> > > >>> destination mgmt { file ("/var/log/fwlogs/management-context.log"); }; >>> > > >>> destination wifi { file ("/var/log/fwlogs/wifi-context.log"); }; >>> destination aplog { file ("/var/log/aplog/aplog.txt"); }; >>> >>> filter aplog { host (10.20.); }; ### this line caused >>> > the > >>> syntax error (line 35) >>> filter gje { host (10.8.30.28); }; >>> filter nes { host (10.8.30.20); }; >>> filter ull { host (10.8.30.36); }; >>> filter hur { host (10.8.30.12); }; >>> filter eid { host (10.8.30.44); }; >>> filter nan { host (10.8.30.52); }; >>> filter datas { host (10.8.0.1); }; >>> filter mgmt { host (10.8.30.60); }; >>> filter wifi { host (10.8.30.92); }; >>> filter asa { host (ASA-R111); }; >>> filter komm { host (10.8.30.76); }; >>> filter edb { host (edb-pix); }; >>> >>> filter emerg { level (emerg); }; >>> filter alert { level (alert .. emerg); }; >>> filter crit { level (crit .. emerg); }; >>> filter err { level (err .. emerg); }; >>> filter warning { level (warning .. emerg); }; >>> filter notice { level (notice .. emerg); }; >>> filter info { level (info .. emerg); }; >>> filter debug { level (debug .. emerg); }; >>> filter kern { facility (kern); }; >>> filter user { facility (user); }; >>> filter mail { facility (mail); }; >>> filter daemon { facility (daemon); }; >>> filter auth { facility (auth); }; >>> filter syslog { facility (syslog); }; >>> filter lpr { facility (lpr); }; >>> filter news { facility (news); }; >>> filter uucp { facility (uucp); }; >>> filter cron { facility (cron); }; >>> #filter local0 { facility (local0); }; >>> #filter local1 { facility (local1); }; >>> #filter local2 { facility (local2); }; >>> #filter local3 { facility (local3); }; >>> #filter local4 { facility (local4); }; >>> #filter local5 { facility (local5); }; >>> #filter local6 { facility (local6); }; >>> #filter local7 { facility (local7); }; >>> filter user_none { not facility (user); }; >>> filter kern_debug { filter (kern) and filter (debug); }; >>> filter daemon_notice { filter (daemon) and filter (notice); }; >>> filter mail_crit { filter (mail) and filter (crit); }; >>> filter mesg { filter (kern_debug) or >>> filter (daemon_notice) or >>> filter (mail_crit); }; >>> filter authinfo { filter (auth) or program (sudo); }; >>> >>> log { source (sys); destination(messages); }; >>> log { source (sys); destination(console_all); }; >>> log { source (sys); filter (authinfo); destination (authlog); }; >>> log { source (sys); filter (mail); destination (maillog); }; >>> #log { source (sys); filter (local0); destination (ipflog); }; >>> #log { source (sys); filter (local1); destination (imaplog); }; >>> log { source (sys); filter (syslog); destination (syslog); }; >>> log { source (sys); filter (emerg); filter (user_none); >>> destination (console); }; >>> log { source (sys); filter (mesg); filter (user_none); >>> destination (messages); }; >>> >>> log { source (net); destination (clients); }; >>> log { source (net); filter (komm); destination (komm); }; >>> log { source (net); filter (asa); destination (asa); }; >>> log { source (net); filter (mgmt); destination (mgmt); }; >>> log { source (net); filter (wifi); destination (wifi); }; >>> log { source (net); filter (datas); destination (datas); }; >>> log { source (net); filter (wifi); destination (wifi); }; >>> log { source (net); filter (gje); destination (gje); }; >>> log { source (net); filter (nan); destination (nan); }; >>> log { source (net); filter (ull); destination (ull); }; >>> log { source (net); filter (hur); destination (hur); }; >>> log { source (net); filter (eid); destination (eid); }; >>> log { source (net); filter (nes); destination (nes); }; >>> log { source (net); filter (edb); destination (edb); }; >>> log { source (net); filter (aplog); destination (aplog); }; >>> #log { source (net); filter (komm); destination (komm); }; >>> ---------------------------------------------------------------------- >>> This is the error i got : >>> >>> syntax error in /etc/syslog-ng/syslog-ng.conf at line 35. >>> >>> syslog-ng documentation: >>> http://www.balabit.com/support/documentation/?product=syslog-ng >>> mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> > > >>> >>> * Configuration error. Please fix your configfile >>> (/etc/syslog-ng/syslog-ng.conf) >>> >>> It is not a very big deal at the moment, as i've reverted back to version >>> > > >>> 2.1.4, but i'd like to keep my system current, and somewhat up to date. >>> >> this >> >>> server's main function is as a syslogger for a few firewalls though, so i >>> > > >>> cannot leave it unable to log for long. >>> >>> hope someone can help. >>> >>> cheers >>> andip >>> >>> > _____________________________________________________________________________ > > >> _ >> >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation: >>> >> http://www.balabit.com/support/documentation/?product=syslog-ng >> >>> FAQ: http://www.campin.net/syslog-ng/faq.html >>> >>> >>> >>>

2 1

Licensing of 3.0.2 OSE ?
by Fegan, Joe 15 Dec '09

15 Dec '09

Hi all - A licensing question about syslog-ng was sent to me privately recently and I thought it would be best to forward it to this list for comments. > We have been using syslog-ng-1.6.2 in our product for quite a few years now. > We received a case recently on syslog-ng which prompted us to get the newer > version of syslog-ng. We took the syslog-ng_3.0.2 open source edition and > replaced the older one with this. > > We see that the licensing has changed from GPL to BalaBit Proprietary License > since syslog-ng version 3.0.1. The license remains GPL till syslog-ng version > 2.1.4. > > My question here is, can we build the newer open source syslog-ng which has > the Balabit propriety license and distribute it to our customers as part of > our product? I replied that the COPYING file in the 3.0.2 tarball says GPL, so I don't understand the question. The person's reply was: > Joe, > > I missed out on mentioning that part to you. > The COPYING is GPL. But in the spec file we see the following. > > # > # Specfile used by BalaBit internally. > # > Summary: Next generation system logging daemon > Name: syslog-ng > Version: 3.0.1 > Release: 1 > License: BalaBit Proprietary License > > And this is seen when you do rpm -qi : > > [root@n10 ~]# rpm -qi syslog-ng-xx-3.0.2-1 > Name : syslog-ng-xx Relocations: (not relocatable) > Version : 3.0.2 Vendor: Balabit IT Ltd. > Release : 1 Build Date: Mon 07 Dec 2009 06:40:22 PM IST > Install Date: Thu 10 Dec 2009 02:01:43 PM IST Build Host: builder.mycompany.com > Group : System Environment/Daemons Source RPM: syslog-ng-xx-3.0.2-1.src.rpm > Size : 554028 License: BalaBit Proprietary License > Signature : (none) > Packager : Tamas Pal <folti(a)balabit.com> > URL : http://www.balabit.com > Summary : Next generation system logging daemon > Description : > Syslog-ng is a next generation system logger daemon which provides more > capabilities and it has a more flexible configuration then the traditional > syslog daemon.

3 3

Re: [syslog-ng] syntax error in config-file
by andip 15 Dec '09

15 Dec '09

Hi, You're right i got the syslog filter, but not destination. i changed that to _syslog, and as i started syslog-ng again, i got syntax-errors on different lines. i fixed the lines one after the other (see comments in config file in original mail). the last error that i could not get past was on line 35, which is the first filter-line in my config-file. so since syslog-ng exited with syntax-error, and it reports it being line 35, i felt sure it had to do with that line, though ofc i can be wrong as i'm an amateur. i am ofc aware there are/might be errors further down in the config-file. i'd very much like to be certain though, before i re-install version 3.0.4 again. could you please confirm for me that you're aware of this before i try out your suggested solution? cheers andip ----- Original Message ----- From: Pallagi Zoltán <pzolee(a)balabit.hu> To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu>, andip(a)syndig.com Sent: Tue, 15 Dec 2009 10:43:10 +0100 Subject: Re: [syslog-ng] syntax error in config-file > Hi, > > In syslog-ng 3.0, "syslog" became a reserved word and you have a > destination and a filter called "syslog" in your config. > Please rename them and it will work > > andip írta: > > Hi folks, > > > > I just tried updating syslog-ng to version 3.0.4, from 2.1.4. i use the > > gentoo linux-distro, and the new version came into "stable" gentoo a few > days > > ago. > > > > I'm no syslog-ng expert, but i use it to log quite a few things, so my > > config-file it not default. > > I've read a bit in the admin-guide, but did not find any reason to my > > problem. > > > > i've tried converting my 2.1.4 config-file to the new 3.0.4 version, with > no > > success. this is parts of my old config-file. ### are comments made to > > reflect changes i made for v2 -> v3 conversion > > > ---------------------------------------------------------------------------- > > options { > > chain_hostnames(off); ### changed this to "no" > > sync(0); ### changed this to "flush_lines" > > time_sleep(20); > > log_fifo_size (2048); > > create_dirs (yes); > > perm (0640); > > dir_perm (0750); > > stats(43200); ### changed this to "stats_freq" > > owner (syslogger); > > group (syslogger); > > perm (0664); > > }; > > > > source sys { > > unix-stream("/dev/log" max-connections(256)); > > internal(); > > file("/proc/kmsg"); > > }; > > > > source net { udp(); }; > > > > destination clients { file ("/var/log/fwlogs/netclients/$HOST"); }; > > destination console_all { file ("/dev/tty12"); }; > > destination authlog { file ("/var/log/authlog"); }; > > destination messages { file ("/var/log/messages"); }; > > destination maillog { file ("/var/log/maillog"); }; > > destination ipflog { file ("/var/log/ipflog"); }; > > destination imaplog { file ("/var/log/imaplog"); }; > > destination console { file ("/dev/console"); }; > > destination syslog { file ("/var/log/syslog"); }; ### changed > to _syslog > > > > > destination komm { file ("/var/log/fwlogs/kommunikasjon-context.log"); > > > }; > > destination asa { file ("/var/log/fwlogs/asa.log"); }; > > destination edb { file ("/var/log/fwlogs/edb-pix.log"); }; > > destination gje { file ("/var/log/fwlogs/gjerdrum.log"); }; > > destination nes { file ("/var/log/fwlogs/nes.log"); }; > > destination ull { file ("/var/log/fwlogs/ullensaker.log"); }; > > destination hur { file ("/var/log/fwlogs/hurdal.log"); }; > > destination eid { file ("/var/log/fwlogs/eidsvoll.log"); }; > > destination nan { file ("/var/log/fwlogs/nannestad.log"); }; > > destination datas { file ("/var/log/fwlogs/datasenter-context.log"); }; > > > > > destination mgmt { file ("/var/log/fwlogs/management-context.log"); }; > > > > > destination wifi { file ("/var/log/fwlogs/wifi-context.log"); }; > > destination aplog { file ("/var/log/aplog/aplog.txt"); }; > > > > filter aplog { host (10.20.); }; ### this line caused the > > syntax error (line 35) > > filter gje { host (10.8.30.28); }; > > filter nes { host (10.8.30.20); }; > > filter ull { host (10.8.30.36); }; > > filter hur { host (10.8.30.12); }; > > filter eid { host (10.8.30.44); }; > > filter nan { host (10.8.30.52); }; > > filter datas { host (10.8.0.1); }; > > filter mgmt { host (10.8.30.60); }; > > filter wifi { host (10.8.30.92); }; > > filter asa { host (ASA-R111); }; > > filter komm { host (10.8.30.76); }; > > filter edb { host (edb-pix); }; > > > > filter emerg { level (emerg); }; > > filter alert { level (alert .. emerg); }; > > filter crit { level (crit .. emerg); }; > > filter err { level (err .. emerg); }; > > filter warning { level (warning .. emerg); }; > > filter notice { level (notice .. emerg); }; > > filter info { level (info .. emerg); }; > > filter debug { level (debug .. emerg); }; > > filter kern { facility (kern); }; > > filter user { facility (user); }; > > filter mail { facility (mail); }; > > filter daemon { facility (daemon); }; > > filter auth { facility (auth); }; > > filter syslog { facility (syslog); }; > > filter lpr { facility (lpr); }; > > filter news { facility (news); }; > > filter uucp { facility (uucp); }; > > filter cron { facility (cron); }; > > #filter local0 { facility (local0); }; > > #filter local1 { facility (local1); }; > > #filter local2 { facility (local2); }; > > #filter local3 { facility (local3); }; > > #filter local4 { facility (local4); }; > > #filter local5 { facility (local5); }; > > #filter local6 { facility (local6); }; > > #filter local7 { facility (local7); }; > > filter user_none { not facility (user); }; > > filter kern_debug { filter (kern) and filter (debug); }; > > filter daemon_notice { filter (daemon) and filter (notice); }; > > filter mail_crit { filter (mail) and filter (crit); }; > > filter mesg { filter (kern_debug) or > > filter (daemon_notice) or > > filter (mail_crit); }; > > filter authinfo { filter (auth) or program (sudo); }; > > > > log { source (sys); destination(messages); }; > > log { source (sys); destination(console_all); }; > > log { source (sys); filter (authinfo); destination (authlog); }; > > log { source (sys); filter (mail); destination (maillog); }; > > #log { source (sys); filter (local0); destination (ipflog); }; > > #log { source (sys); filter (local1); destination (imaplog); }; > > log { source (sys); filter (syslog); destination (syslog); }; > > log { source (sys); filter (emerg); filter (user_none); > > destination (console); }; > > log { source (sys); filter (mesg); filter (user_none); > > destination (messages); }; > > > > log { source (net); destination (clients); }; > > log { source (net); filter (komm); destination (komm); }; > > log { source (net); filter (asa); destination (asa); }; > > log { source (net); filter (mgmt); destination (mgmt); }; > > log { source (net); filter (wifi); destination (wifi); }; > > log { source (net); filter (datas); destination (datas); }; > > log { source (net); filter (wifi); destination (wifi); }; > > log { source (net); filter (gje); destination (gje); }; > > log { source (net); filter (nan); destination (nan); }; > > log { source (net); filter (ull); destination (ull); }; > > log { source (net); filter (hur); destination (hur); }; > > log { source (net); filter (eid); destination (eid); }; > > log { source (net); filter (nes); destination (nes); }; > > log { source (net); filter (edb); destination (edb); }; > > log { source (net); filter (aplog); destination (aplog); }; > > #log { source (net); filter (komm); destination (komm); }; > > ---------------------------------------------------------------------- > > This is the error i got : > > > > syntax error in /etc/syslog-ng/syslog-ng.conf at line 35. > > > > syslog-ng documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > > * Configuration error. Please fix your configfile > > (/etc/syslog-ng/syslog-ng.conf) > > > > It is not a very big deal at the moment, as i've reverted back to version > > 2.1.4, but i'd like to keep my system current, and somewhat up to date. > this > > server's main function is as a syslogger for a few firewalls though, so i > > cannot leave it unable to log for long. > > > > hope someone can help. > > > > cheers > > andip > > > _____________________________________________________________________________ > _ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.campin.net/syslog-ng/faq.html > > > > > >

1 0