- syslog-ng - lists.balabit.hu

Colon embedded in messages (:)
by James Kelly 29 Sep '09

29 Sep '09

Hello, I am attempting to implement syslog-ng on our servers hosting postgresql databases. The general idea is to log "too much" at the database level and then, using syslog filters, reduce it to the information we want to actually hold in the syslog and send to the log server. So far I am extremely pleased with how easy it is to implement and well documented. However, I do have one problem that is making it difficult to use. The problem is for each message that the filter matches, it does not completely drop the message.. rather, it logs the date / server / and a colon: For example, this is what I get for a message that is matched by a filter: "Sep 29 09:43:29 hcdb1-rep2 :" I notice that even with the unmatched statements, there is a colon. For example, in the postgresql log, I see: insert into "public"."table"(blah,blah,blah) values (blah,blah,blah); but the same message once captured from syslog shows the following in the log and logserver: Sep 29 09:43:29 hcdb1-rep2 insert: into "public"."table"(blah,blah,blah) values (blah,blah,blah); *Note the colon after "insert".* I can't seem to figure out where this is coming from or how to avoid it. It also causes some filtering problems that I won't go into here so as to not confuse the issues, but safe to say it is also related to the colon. I have spent a lot of time trying to figure this out and am at a dead-end. Due to the amount of messages I need to filter out (below is just one of the many filters I need to put in and have tested with the same result), not being able to completely filter these out is a killer. I am using the 3.0.4 open-source edition on Ubuntu 8. Here is my config: ****************************************************************************************** @version: 3.0 options { }; ###### # sources source s_local { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" program_override("kernel: ")); file("/var/log/postgresql/postgresql-8.3-main.log"); }; ###### # destinations destination d_messages { file("/var/log/messages"); }; ##### # filters filter f_inserts2 { not match("_health_central" value("MESSAGE")); }; destination d_logserver { tcp("internal.host.com"); }; log { source(s_local); filter(f_inserts2); destination(d_messages); #destination(d_logserver); }; ****************************************************************************************** Thanks! James Kelly

4 6

Re: [syslog-ng] sun solaris syslogng error
by list＠net-secured.com 29 Sep '09

29 Sep '09

1 0

sun solaris syslogng error
by list＠net-secured.com 29 Sep '09

29 Sep '09

3 3

Syslog-ng 3
by Ashish Shrimali 29 Sep '09

29 Sep '09

Hi All, My Syslog-ng is running , which I can see by ps -ef command, but still it is not writing to the log file. I have specified the log file in the conf dir. Any inputs would be highly appreciated. Thanks & Regards, Ashish Shrimali -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Tuesday, September 29, 2009 3:11 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 53, Issue 21 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Solaris Syslog-ng install lib error (list(a)net-secured.com) 2. Re: Solaris Syslog-ng install lib error (Srinivasan Sreenivasan) 3. sun solaris syslogng error (list(a)net-secured.com) 4. syslog-ng client machine IP address in message header (Jain, Vaibhav (GE Healthcare)) ---------------------------------------------------------------------- Message: 1 Date: Mon, 28 Sep 2009 03:52:33 -0700 From: list(a)net-secured.com Subject: [syslog-ng] Solaris Syslog-ng install lib error To: "syslogng " <syslog-ng(a)lists.balabit.hu> Message-ID: <20090928035233.9419518bf8837c8c492fb3b5d9b71733.3b4f820868.wbe(a)email03.secureserver.net> Content-Type: text/plain; charset="us-ascii" An HTML attachment was scrubbed... URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20090928/9ae9e2ac/a… ------------------------------ Message: 2 Date: Mon, 28 Sep 2009 08:00:09 -0500 From: Srinivasan Sreenivasan <srinivasan.srinivasan(a)sabre.com> Subject: Re: [syslog-ng] Solaris Syslog-ng install lib error To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <C6E61D89.5EF6%srinivasan.srinivasan(a)sabre.com> Content-Type: text/plain; charset="us-ascii" The PKG_CONFIG_PATH should include directories that have .pc files in them. On 9/28/09 5:52 AM, "list(a)net-secured.com" <list(a)net-secured.com> wrote: > Hi > I tryed to install on Sparc v. 10 syslog-ng v3.0.4, runnning: ./configure > --enable-sun-streams, --enable-sun-door gives this warning: > configure: WARNING: unrecognized options: --enable-sun-streams, > --enable-sun-door > > any ideas? > > > > furthermore, I get this error: > checking for GLIB - version >= 2.10.1... no > *** Could not run GLIB test program, checking why... > *** The test program failed to compile or link. See the file config.log for > the > *** exact error that occured. This usually means GLIB is incorrectly > installed. > configure: error: Cannot find GLIB version >= 2.10.1: is pkg-config in path? > > === > Adding the path below : produces another error > > export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/:/usr/lib/pkgconfig/ > > checking for LIBDBI... Package dbi was not found in the pkg-config search > path. > Perhaps you should add the directory containing `dbi.pc' > to the PKG_CONFIG_PATH environment variable > No package 'dbi' found > no > checking for dbi_initialize in -ldbi... no > checking pthread.h usability... yes > checking pthread.h presence... yes > checking for pthread.h... yes > checking for pthread_create in -lpthread... yes > checking for LIBNET... no > checking whether to enable Sun STREAMS support... yes > checking whether to enable Sun door support... yes > checking whether to enable IPv6 support... yes > checking whether to enable SQL support... no > checking whether to enable Linux capability support... no > checking whether to enable PCRE support... yes > checking for pkg-config... (cached) /usr/bin/pkg-config > checking pkg-config is at least version 0.14... yes > checking for GLIB - version >= 2.10.1... yes (version 2.14.1) > checking for EVTLOG... yes > checking for LIBNET... configure: error: libnet-config not found > > > thanks > > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html >

2 1

Solaris Syslog-ng install lib error
by list＠net-secured.com 28 Sep '09

28 Sep '09

2 1

Re: [syslog-ng] empty syslog-ng log on Solaris 10
by list＠net-secured.com 26 Sep '09

26 Sep '09

1 0

empty syslog-ng log on Solaris 10
by list＠net-secured.com 25 Sep '09

25 Sep '09

2 1

flags(final)
by Michael J. Bauer 25 Sep '09

25 Sep '09

I think I am misunderstanding what flags(final) is supposed to do. I'm running syslog-ng 2.1.4 on RHEL 5.4 (Tikanga). I have a fairly simple syslog-ng configuration, which I've attached below. I'm trying to pick off individual groups of log entries and put them in their own individual files. I want to ensure that each gets logged exactly once, so I'm using flags(final). I also have a catch-all at the end in case I've missed something, but the ultimate goal is to have that file present, but empty. However, with this configuration, the log entries that appear in d_network_address_translation (/var/log/network-address-translation) also appear in d_default (/var/log/default) despite the presence of flags(final) on an earlier log() line. Should it work this way? If so, what can I do to get the desired behavior? Thanks, MJB options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination d_network_address_translation { file("/var/log/network-address-translation"); }; destination d_default { file("/var/log/default"); }; filter f_network_address_translation { host("router-service-interface") and priority(info) and facility(local2) and match("FWNAT"); }; log { source(s_sys); filter(f_network_address_translation); destination(d_network_address_translation); flags(final); }; log { source(s_sys); destination(d_default); };

2 2

Can't get syslog-ng to accept my ldap log-conf
by Wilhelm Linder Rosén 25 Sep '09

25 Sep '09

Hi people! I can't seem to get syslog-ng to start with my conf. Can anyone help me out with my conf? The ldap part looks like this: source s_all { unix-stream("/dev/log"); internal(); }; destination d_ldap { file("/var/log/ldap[?].log"); }; filter f_syslog { not facility(auth, authpriv) and not match(slapd); }; filter f_ldap { match("slapd"); }; log { source(s_all); filter(f_syslog); destination(d_syslog); }; log { source(s_all); filter(f_ldap); destination(d_ldap); }; Thanks in advance, and have a great weekend =) // Wilhelm Linder Rosén

2 1

Syslog-ng is always one message behing with a tcp destination
by Srinivasan Sreenivasan 25 Sep '09

25 Sep '09

> Hi, > > I have a "client" syslog-ng that reads from a unix domain socket and writes to > a file destination as well as a tcp destination. I have a "server" syslog-ng > listening on 0.0.0.0 on the port specified in the "client" tcp destination. > > When I write a sample payload to the domain socket, syslog-ng writes the > message in full to the file destination immediately. However I see no file > created on the host referred to by tcp destination. > > If I write a second payload, the first payload is now written to the remote > location specified in the tcp destination. > > It seems like syslog-ng is always one message behind in writing to the tcp > destination. > > I am able to flush the "client" syslog-ng buffer by sending a kill -1. This > causes the payload to be written to the tcp destination. > > Is this the only way to force syslog-ng to write all its buffer contents to > the tcp destination? Or is there someway to control the flushing using > flow-control? > > > "client" syslog-ng configuration: > > @version: 3.0 > > options { > flush_timeout(1000); > }; > > source s_socks { > unix-stream ("/home/srini/dev/log" > max-connections(5) > log_msg_size(3145728) > flags(no-parse)); > > }; > > destination d_logs { > file("/logs/app.log"); > }; > > destination d_tcp { > tcp("192.168.1.102" port(60999) > frac_digits(6) > keep-alive(yes) > ); > }; > > rewrite r_rewrite_newlines{ > subst("#012", "\n", value("MESSAGE"), flags("global")); > }; > > log { > source(s_socks); > rewrite(r_rewrite_newlines); > destination(d_logs); > }; > > log { > source(s_socks); > destination(d_tcp); > }; > > > "Server" syslog-ng: This is the "centralized" log server: > > @version: 3.0 > > source s_tcp { > tcp(port(60999)) > log_msg_size(3145728) > keep-alive(yes) > }; > > > destination d_logs { > file("/logs/app.llog" > }; > > rewrite r_rewrite_newlines{ > subst("#012", "\n", value("MESSAGE"), flags("global")); > }; > > log { > source(s_tcp); > rewrite(r_rewrite_newlines); > destination(d_logs); > }; > > > Thanks. > Srini >

1 0