- syslog-ng - lists.balabit.hu

apache/jboss/log4j filters
by Adam Harvey 08 Oct '09

08 Oct '09

Good morning, I'm trying to log numerous hosts to a central server. The remote servers are running apache and jboss. Jboss logs to a single file locally, apache logs to numerous files based upon access/errors locally. Having a difficult time filtering the input streams from remote hosts to log these files (or should I even be filtering?) Trying to decide if syslog-ng is the right way to centralize these logs for collection. Any ideas/feedback is very appreciated. Thanks, Adam

1 0

Forward syslog messages unchanged
by PAUL WILLIAMSON 07 Oct '09

07 Oct '09

I found a thread from about 5 years ago where someone wanted to forward messages untouched to another system, but there never was a follow up to say if it was possible. I need to do that, but the messages are still getting to the remote system with my ip address as the source. I have the keep_hostnames(yes) global option set, and I'm still having the problem. Is there any other option I may not know about to do this? Do I need to set up another syslog-ng enabled server and have that system read from there instead of me forwarding the events right to that machine's port? Thanks, Paul ************************************ This email may contain privileged and/or confidential information that is intended solely for the use of the addressee. If you are not the intended recipient or entity, you are strictly prohibited from disclosing, copying, distributing or using any of the information contained in the transmission. If you received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. This communication may contain nonpublic personal information about consumers subject to the restrictions of the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. You may not directly or indirectly reuse or disclose such information for any purpose other than to provide the services for which you are receiving the information. There are risks associated with the use of electronic transmission. The sender of this information does not control the method of transmittal or service providers and assumes no duty or obligation for the security, receipt, or third party interception of this transmission. ************************************

2 1

syslog-ng with sql() command, cpu to 100%
by Garry De Toffoli 07 Oct '09

07 Oct '09

I have tried to use strace, and this is what is reported: 15:16:09.221845 execve("/opt/syslog-ng/sbin/syslog-ng", ["/opt/syslog-ng/sbin/syslog-ng", "-f", "/opt/syslog-ng/etc/syslog-ng.conf"], [/* 16 vars */]) = 0 15:16:09.232664 brk(0) = 0x83e2000 15:16:09.232971 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:16:09.233274 mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb801d000 15:16:09.233520 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) 15:16:09.233717 open("/opt/syslog-ng/lib/tls/i686/sse2/cmov/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory) 15:16:09.236940 stat64("/opt/syslog-ng/lib/tls/i686/sse2/cmov", 0xbf83a9e0) = -1 ENOENT (No such file or directory) 15:16:09.237178 open("/opt/syslog-ng/lib/tls/i686/sse2/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory and it is looping with these error messages: 15:16:09.237751 stat64("/opt/syslog-ng/lib/tls/i686/cmov", 0xbf83a9e0) = -1 ENOENT (No such file or directory) 15:16:09.237930 open("/opt/syslog-ng/lib/tls/i686/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory) 15:16:09.238125 stat64("/opt/syslog-ng/lib/tls/i686", 0xbf83a9e0) = -1 ENOENT (No such file or directory) 15:16:09.238296 open("/opt/syslog-ng/lib/tls/sse2/cmov/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory) 15:16:09.238488 stat64("/opt/syslog-ng/lib/tls/sse2/cmov", 0xbf83a9e0) = -1 ENOENT (No such file or directory) On my Linux box there is no /etc/ld.so.nohwcap, and there is no "tls" path under the "lib" path of syslog-ng I have used the compiled version of syslog-ng ./syslog-ng -V syslog-ng 3.0.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#1b5d618e301ad94aa20e692ffba16469dece8d10 Compile-Date: Aug 5 2009 17:38:20 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: on Enable-Pcre: off Thank you > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 7 Oct 2009 11:36:17 +0200 > From: Sandor Geller <Sandor.Geller(a)morganstanley.com> > Subject: Re: [syslog-ng] syslog-ng with sql() command, cpu to 100% > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <edabd2010910070236h460880edp4e824905927d9883(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi, > > > it seems that the sql() statement go in loop; > > > > where is the error? > > Could you attach strace on syslog-ng, preferably restarting syslog-ng > under strace? Something like > > strace -ff -tt -s 128 -p <PID of running syslog-ng> -o syslogstrace > > In the resulting files you could either find the cause of the problem, > or you could send us some details about what's going on. > > Regards, > > Sandor > > > ------------------------------ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > End of syslog-ng Digest, Vol 54, Issue 7 > **************************************** _________________________________________________________________ Gossip, Sport, Notizie... Accendi la Messenger TV! http://www.messenger.it/messengerTV.aspx

3 2

[Fwd: Re: up to date syslog-ng.conf ?]
by Pallagi Zoltán 07 Oct '09

07 Oct '09

1 0

syslog-ng with sql() command, cpu to 100%
by Garry De Toffoli 07 Oct '09

07 Oct '09

I have tried to run syslog-ng in this way: root@syslog-srv904:/opt/syslog-ng/sbin# ./syslog-ng -f /opt/syslog-ng/etc/syslog-ng.conf without any option of debug; on syslog-ng.conf there is: destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslogadmin") password("syslogadmin") database("syslog") table("logs") columns("host", "facility", "priority", "level", "tag", "datetime", "program", "msg") values("$HOST", "$FACILITY", "$PRIORITY", "$LEVEL", "$TAG", "$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC", "$PROGRAM", "$MSG") indexes()); }; MySql is configured to accept the configuration from network, so the host("127.0.0.1") username("syslogadmin") password("syslogadmin") is correct; and the CPU run to 100% and doesn't write anything to dbase; but if use this configuration destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; run OK; it seems that the sql() statement go in loop; where is the error? Someone can send a configuration that run OK? Thank you. _________________________________________________________________ Scopri tutti i servizi Windows Live, guarda i video http://www.windowslive.it/videoGallery.aspx

2 1

up to date syslog-ng.conf ?
by Jean F. Mousinho 06 Oct '09

06 Oct '09

Hello, I'm trying to use a compiled version of syslog-ng (3.0.4) tho I'm not successful to find a syslog-ng.conf file that cames with that package and is up to date. Find reveals several configuration files: ./debian/syslog-ng.conf ./contrib/hpux-packaging/syslog-ng.conf ./contrib/rhel-packaging/syslog-ng.conf ./contrib/aix-packaging/syslog-ng.conf ./contrib/fedora-packaging/syslog-ng.conf tho, none of them has @version keyword in the head, so syslog-ng is nagging for not being able to determine the configuration version. I'm running syslog-ng manually from the ./src specifing the configuration file from the command line (using -f). So the question is, where is the syslog-ng.conf for the 3.0.4 version (after doing ./configure .. and make) ? Thanks for your help. Jean F. Mousinho

2 1

Forwarding messages
by PAUL WILLIAMSON 05 Oct '09

05 Oct '09

I am receiving messages from 5 devices that I need to send to a remote machine for specific analysis. Right now, the messages are getting interpreted as coming from the central syslog host, not the individual devices. Is there any option to tell syslog-ng to forward as the original hostname, or should I focus on looking for options in the other system? I have the keep_hostname(yes) option enabled, but that isn't working the way I was hoping. Thanks, Paul ************************************ This email may contain privileged and/or confidential information that is intended solely for the use of the addressee. If you are not the intended recipient or entity, you are strictly prohibited from disclosing, copying, distributing or using any of the information contained in the transmission. If you received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. This communication may contain nonpublic personal information about consumers subject to the restrictions of the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. You may not directly or indirectly reuse or disclose such information for any purpose other than to provide the services for which you are receiving the information. There are risks associated with the use of electronic transmission. The sender of this information does not control the method of transmittal or service providers and assumes no duty or obligation for the security, receipt, or third party interception of this transmission. ************************************

2 1

syslog-ng logging from localhost
by Stefan Varga 01 Oct '09

01 Oct '09

Hi we have a syslog-ng configuration see bellow, running on solaris if I telnet to 10.128.240.100 from server where syslog-ng is running, nothing is logged if I telnet to 10.128.240.100 from any other server it is logging as expected do you see something obvious here ? Thanks, Stefan #@version: 3.0 options { create_dirs(yes); owner(root); group(logs); perm(0644); dir_perm(0755); flush_lines(0); log_fifo_size(2048); log_msg_size(8192); stats_freq(3600); long_hostnames(off); keep_hostname(no); use_dns(yes); }; source s_remote { udp(ip(10.128.240.100) port(514)); tcp(ip(10.128.240.100) port(514) max_connections(1000)) }; # remote hosts to files destination r_messages { file ("/logs/hosts/${HOST}/${HOST}-${YEAR}${MONTH}${DAY}"); }; # remote logs log { source (s_remote); filter (f_debug); destination (r_messages); };

2 2

Strange behaviour of syslog-ng. Date macros not working and missing character in file name.
by Nilshar 30 Sep '09

30 Sep '09

Hello, I got a strange problem with syslog-ng (Debian Lenny version (2.0.9)). I got the following configuration : destination df_va_access { file("/var/log/apache/${PROGRAM}-access-${YEAR}${MONTH}${WEEK}${DAY}00.log" perm(0660) dir_perm(0775) template("${MSGONLY}\n") template_escape(off)) ; }; filter f_va_access { facility(local1) and level(info); }; log { source(s_all); filter(f_va_access); destination(df_va_access); flags(final); }; My apache is sending logs to logger with these parameters : /usr/bin/logger -p local1.info -t 180630f354399af972469030e7583848/4f88a0b758d5c5dc46e7f15b4bac1f5c/www.example.com-80-180630f354399af972469030e7583848-4f88a0b758d5c5dc46e7f15b4bac1f5c But I end up with this file : /var/log/apache/30f354399af972469030e7583848/4f88a0b758d5c5dc46e7f15b4bac1f5c/www.example.com-80-180630f354399af972469030e7583848-4f88a0b758d5c5dc46e7f15b4bac1f5c-access-197001000100.log This file has 2 problems : 1) the first directory is missing 3 char : 30f354399af972469030e7583848 should be 180630f354399af972469030e7583848 2) the date is wrong : 197001000100. should be the current date (system date is good). This looks like an overflow or something... I tried setting up another conf with simplier file, the date is working fine. The *very* strange thing, is that I got the same setup (with différents UID) on many differents box, and it's working just fine. So I guess there is something wrong with these particulier UID Is this a known issue ? maybe already fixed in recent version ? Why it is working on most of my box but not this one ? Thanks for your help.

2 2

Host filter not working?
by Clayton Dukes 30 Sep '09

30 Sep '09

I think I'm going crazy... Can someone tell me why this is not filtering these hosts? filter f_not_unitylab { ( not host ("localhost") or not host ("vnt-cm") or not host ("ecats-cu") ); }; # Tell syslog-ng to log to our new destination log { source(s_all); filter(f_not_unitylab); destination(d_logzilla); }; When I start syslog-ng, I'm still getting events logged to my db for these hosts. What am I missing? -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

3 3