- syslog-ng - lists.balabit.hu

log analyzer
by dreamywoman 04 Aug '09

04 Aug '09

hi everybody I would like to know that what web analyzer i can integrate with syslog-ng ? Best Roya

3 2

analyzer
by dreamywoman 02 Aug '09

02 Aug '09

Hi all Tanx for ur reply but I have installed php-syslog-ng but i need something more. I need one analyzer that realize attacks because I have different mailer. Best Roya

1 0

syslog-ng stops accepting new connections every 100-110 minutes
by Matt Pinkham 31 Jul '09

31 Jul '09

For the last 24 hours on versions 2.0.4, 2.1.4, & 3.0.3 syslog-ng will stop taking new connections via a listening port every 100-110 minutes (aka it will hang up immediately). It will never recover on its own and has to be restarted. I haven't figured out the exact interval but hopefully that will be close enough to work with (note that the traffic is fairly low -- 10 mesgs/sec -- 500K-600K data/min). I had a program logging data locally via /dev/log into a named directory and then moved this program to a remote server. That remote server does not seem to be having an issue. I have observed this issue on two separate servers (RHEL4.[image: Cool] that were taking this data feed. I have tried with flush_lines/sync & time_reopen commented out with no difference as well as log_fifo_size, log_mesg_size,so_recvbuf commented out. There are no obvious messages about why syslog-ng stops working (even with debug and verbose enabled). Note that these two servers (that stop working) are behind an Alteon 2424 switch (although I have other feeds to other servers working fine behind this switch). Ideas? Need more data? ==syslog will stop accepting connections== [root@server]# telnet localhost 514 Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. Connection closed by foreign host. ==top section of 3.0 syslog-ng.conf== options { flush_lines (0); time_reopen (10); log_fifo_size (10000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); dir_perm (0755); perm (0644); chain_hostnames(no); keep_hostname (yes); stats_freq (3600); log_msg_size(65536); }; source remote { udp(ip(0.0.0.0) port(514) so_rcvbuf(1048576)); tcp(ip(0.0.0.0) port(514) max-connections(50) so_rcvbuf(1048576)); }; ==logging data like this=== filter f_data { match("Data:"); }; destination d_data { file("/var/log/data/data-$R_MONTH$R_DAY$R_HOUR$R_MIN"); }; log { source(remote); filter(f_data); destination(d_data); };

3 6

Problem with static linking glib on Solaris
by kdajka 30 Jul '09

30 Jul '09

Hi, I'm trying to compile latest stable syslog-ng (3.0.3) release on Solaris 10. I have compiled glib (2.10.3) with ./configure --enable-static --with-libiconv --prefix=/usr/local/inp/glib. Eventlog was installed by Sun administrator in my company: $pkginfo |grep -i event application SMCevtlog eventlog Which is installed to /usr/local/lib Everything is fine if I run configure like this: LD_LIBRARY_PATH=/usr/local/inp/glib/lib:$LD_LIBRARY_PATH PKG_CONFIG_PATH=/usr/local/inp/glib/lib/pkgconfig/:/usr/local/lib/pkgconfig ./configure but if I try compile it with static: LD_LIBRARY_PATH=/usr/local/inp/glib/lib:$LD_LIBRARY_PATH PKG_CONFIG_PATH=/usr/local/inp/glib/lib/pkgconfig/:/usr/local/lib/pkgconfig ./configure --enable-static-linking I'm getting this error: checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for a BSD-compatible install... ./install-sh -c checking whether build environment is sane... ^Z ... ... checking for pkg-config... (cached) /usr/bin/pkg-config checking pkg-config is at least version 0.14... yes checking for GLIB - version >= 2.10.1... yes (version 2.10.3) checking for EVTLOG... yes checking for static GLib libraries... no checking sanity checking Glib headers... yes configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib It says that it couldn't find libglib-2.0.a, even though it is located on my system: $ ls -l /usr/local/inp/glib/lib/libglib-2.0.* -rw-r--r-- 1 webadm webadm 1103212 Jul 29 09:58 /usr/local/inp/glib/lib/libglib-2.0.a -rwxr-xr-x 1 webadm webadm 1236 Jul 29 09:58 /usr/local/inp/glib/lib/libglib-2.0.la lrwxrwxrwx 1 webadm webadm 23 Jul 29 09:58 /usr/local/inp/glib/lib/libglib-2.0.so -> libglib-2.0.so.0.1000.3 lrwxrwxrwx 1 webadm webadm 23 Jul 29 09:58 /usr/local/inp/glib/lib/libglib-2.0.so.0 -> libglib-2.0.so.0.1000.3 -rwxr-xr-x 1 webadm webadm 940008 Jul 29 09:58 /usr/local/inp/glib/lib/libglib-2.0.so.0.1000.3 Is there another variable in which I can specify non-standard place of libglib-2.0.a? My config.log http://pastebin.com/d29c03773

2 2

Errors in Installing Syslog-ng
by Ashish Shrimali 30 Jul '09

30 Jul '09

Hi Team, I'm new to Syslog-ng. I was trying to install Syslog-ng on one of our servers and got the errors as attached. Can you please help me out in this ? Thanks & Regards, Ashish Shrimali -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Wednesday, July 29, 2009 3:34 PM To: Ashish Shrimali Subject: Welcome to the "syslog-ng" mailing list (Digest mode) Welcome to the syslog-ng(a)lists.balabit.hu mailing list! To post to this list, send your email to: syslog-ng(a)lists.balabit.hu General information about the mailing list is at: https://lists.balabit.hu/mailman/listinfo/syslog-ng If you ever want to unsubscribe or change your options (eg, switch to or from digest mode, change your password, etc.), visit your subscription page at: https://lists.balabit.hu/mailman/options/syslog-ng/ashish_shrimali%40infosy… You can also make such adjustments via email by sending a message to: syslog-ng-request(a)lists.balabit.hu with the word `help' in the subject or body (don't include the quotes), and you will get back a message with instructions. You must know your password to change your options (including changing the password, itself) or to unsubscribe. It is: syslog-ng Normally, Mailman will remind you of your lists.balabit.hu mailing list passwords once every month, although you can disable this if you prefer. This reminder will also include instructions on how to unsubscribe or change your account options. There is also a button on your options page that will email your current password to you. **************** CAUTION - Disclaimer ***************** This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message. Further, you are not to copy, disclose, or distribute this e-mail or its contents to any other person and any such actions are unlawful. This e-mail may contain viruses. Infosys has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Infosys reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infosys e-mail system. ***INFOSYS******** End of Disclaimer ********INFOSYS***

2 1

local-remote syslog-ng log collection problem
by linux linux 29 Jul '09

29 Jul '09

hi, I am new in syslog-ng. I want to make my syslog-ng.conf file in such way so it can collect data from remote and local process. After modifying the syslog-ng.conf i am able to collect the log, but problem is am getting the log with localhost insteed of local server ip and remote server ip. But if i restart the syslo-ng and the process then am getting log with my server ip for only that particular process that i have restarted. Could anyone plese let me know why i have to restart the syslog-ng and daemons/processes everytime, though i did not make any change in syslog-ng.conf file. I prepared the bootable iso with my syslog-ng changes so syslog-ng and daemons should pick up my cganges when i install os on the server. Am ii missing something in syslog-ng.conf file or i need to add something in each precess/daemon? Below is code for collect local-remore log. udp(ip(0.0.0.0) port(514)); destination remote {udp("remote server ip" port(514));}; log { source(all); destination(remote); }; Thanks Masami

1 0

Questions about Facility, Priority and Level
by Clayton Dukes 28 Jul '09

28 Jul '09

Hey Guys, According to the documentation: $LEVEL = Importance level of the message represented as a number: 6 - Success, 5 - Informational, 4- Warning, or 3 - Error). $FACILITY = The facility sending the message. $PRI = Priority header of the message, storing the facility and the level of the message. Questions: What is the difference between LEVEL and PRI in syslog-ng? it doesn't seem to be storing anything but the level? When I look in the database, it shows identical information about the two: mysql> select distinct priority from logs; +----------+ | priority | +----------+ | alert | | crit | | debug | | emerg | | err | | info | | notice | | warning | +----------+ mysql> select distinct level from logs; +---------+ | level | +---------+ | err | | info | | notice | | debug | | warning | | crit | | emerg | | alert | +---------+ According to the RFC: The Priority value is calculated by first multiplying the Facility number by 8 and then adding the numerical value of the Severity. For example, a kernel message (Facility=0) with a Severity of Emergency (Severity=0) would have a Priority value of 0. Also, a "local use 4" message (Facility=20) with a Severity of Notice (Severity=5) would have a Priority value of 165. In the PRI part of a syslog message, these values would be placed between the angle brackets as <0> and <165> respectively. The only time a value of "0" will follow the "<" is for the Priority value of "0". Otherwise, leading "0"s MUST NOT be used. So, if that's the case, couldn't I just grab the PRI from the message and store only that in the table and use the code on my end to derive the FAC and SEV (I assume severity = level in syslog-ng)? Also, is there a way to store these as integers from syslog-ng? There's a finite number of all of these, it seems that it would be better/faster to store them as an integer in the table and reference that in my code. Or I could use enum - not sure which is faster. Can I safely drop LEVEL or PRI and only keep one? it seems odd to have two columns for the same thing :-) Thanks! ______________________________________________________________ Clayton Dukes ______________________________________________________________

3 6

Syslog-ng seems to be not parsing correctly if the PROGRAM macro parsing fails.
by Yu Watanabe 27 Jul '09

27 Jul '09

Hello all. I am using syslog-ng v 2.0.5. However, I am gathering logs from the cisco catalyst switches, but when I tried to use the PROGRAM macro it seems not be working properly. In Cisco switches , there seems to be messages that program is not included in the message that is sent from the device. I would like to know how does syslog-ng parses the messages that does not have the PROGRAM name included and what would happen if we use the PROGRAM macro for these message. Following is the proper message: Jul 27 13:17:11 l2swtich 128: %SYS-5-CONFIG_I: Configured from console by console **** There are logs that does not have this part. Regards, Yu Watanabe

3 4

Fastest, most scaleable solution
by Clayton Dukes 25 Jul '09

25 Jul '09

Hi folks, I'm thinking about completely re-writing my app (php-syslog-ng) in order to provide high end scalability and a better (ajax) front end. At the base of it, my biggest concern is scalability. I want to write the backend to be able to handle many thousands of messages per second. In your opinion, what is the best way to accomplish this? Should I: Log everything to MySQL directly? If so, can MySQL handle that insert rate? Log everything to disk and use flat files to do analysis and reporting? Log everything to disk and use MySQL's load_data_infile? Other suggestions? Also, is anyone out there using MySQL for this level of insert rates? Do you have any recommendations on table structures, indexes, etc.? -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

3 6

Syslog-ng log viewer for Postgres
by Craig Ayliffe 24 Jul '09

24 Jul '09

Hi All, Does anyone have any suggestions for a web based viewer like php-syslog-ng but for a Postgres backend? Regards, -- Craig Ayliffe

3 2