- syslog-ng - lists.balabit.hu

Question about logStore alternative ..
by fredzy padzy 07 Apr '09

07 Apr '09

Hy everyone I'm wondering if it's could be possible to make the same thing that the logStore does (even if it's not as strong as, or as efficient as). Actually, it seems that the PreniumVersion of SyslogNG isn't ready yet for my plateform, and i just though about building a kind of 'homemade' logStore. (but of course, not declared in my syslog-ng.conf ... but acting in my txt log file, in a another directory) I'm using AIDE for a few days, but it doesn't look to handle chunks of file, which Prenium Edition seems to use Moreover, it has to be launched every time a log is written, and i'm pretty sure it will warn about a lot of false positive. any idea ???? bye :)

1 0

problem in writing to database 2
by gatfi sami 05 Apr '09

05 Apr '09

i succefully added the folowing script to /etc/profile it recreates the pilpline but when i get access to the virtual machine by ssh it is blocked like this: Password: *Last login: Sun Apr 5 03:08:51 2009 from linux-ux35.lan Have a lot of fun... *i have to tape ctrl + c to have linux-test1:~ # i have to tape ctrl +c to get access to it here is the script #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u root --password= syslog< /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi i think the problem is from mysql -u root --password= syslog< /tmp/mysql.pipe 2009/4/4 gatfi sami <pfegatfi.sami(a)gmail.com> > hi > > i am configuring a centralised syslog server and when i arrived to the > writing into the database there is some thing wrong > > because when i use a file as destination i see incoming logs when i restart > apache2 or mysql in the client > > "tail - f /" > i use syslog -ng 2.0 > > here is the client > *source my_src{ > file("/var/log/apache2/error_log" follow_freq(1) ); > > file("/var/lib/mysql/mysqld.log" follow_freq(1) ); > > }; > > > destination loghost { > tcp("192.168.1.69" port(514)); > }; > log { > source(my_src); > destination(loghost); > };* > > > > here is the server > > * source mysrc{ tcp(ip(0.0.0.0) port(514) keep-alive(yes)); > #udp(); > }; > > destination d_mysql { > pipe("/tmp/mysql.pipe" > template("INSERT INTO logs (host, facility, priority, level, tag, date, > time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', > '$TAG', > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") > template-escape(yes)); > }; > log { source(mysrc); destination(d_mysql); > }; > * > > note that a databes names syslog is already created and contain a table > logs; > > > > if itry the following command : syslog-ng -f /etc/syslog-ng/syslog-ng.conf > > Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already > in use (98)' > Error initializing source driver; source='mysrc' > > > ps i used to use the server as relai and send by udp using the same port > 514 but now everinthing is > > commented like this # > > need help > i added the following script to the file

1 0

problem in writing to database
by gatfi sami 04 Apr '09

04 Apr '09

hi i am configuring a centralised syslog server and when i arrived to the writing into the database there is some thing wrong because when i use a file as destination i see incoming logs when i restart apache2 or mysql in the client "tail - f /" i use syslog -ng 2.0 here is the client *source my_src{ file("/var/log/apache2/error_log" follow_freq(1) ); file("/var/lib/mysql/mysqld.log" follow_freq(1) ); }; destination loghost { tcp("192.168.1.69" port(514)); }; log { source(my_src); destination(loghost); };* here is the server * source mysrc{ tcp(ip(0.0.0.0) port(514) keep-alive(yes)); #udp(); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(mysrc); destination(d_mysql); }; * note that a databes names syslog is already created and contain a table logs; if itry the following command : syslog-ng -f /etc/syslog-ng/syslog-ng.conf Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already in use (98)' Error initializing source driver; source='mysrc' ps i used to use the server as relai and send by udp using the same port 514 but now everinthing is commented like this # need help

1 0

[PATCH] typo in misc.c, function resolve_user?
by Corinna Vinschen 01 Apr '09

01 Apr '09

Hi, a Cygwin user got a message in the syslog every time the syslog-ng service started up: Error resolving user; user='system' He also found why this message was generated. The function resolve_user() in misc.c appears to have a typo. If the incoming user argument points to a non-empty string, resolve_user() just returns NULL. So, the following getpwnam is only called for an empty user string. This looks like a typo. One possible fix below. However, maybe the intention was actually to test for if (!user) instead of if (!*user) ??? Corinna --- src/misc.c.ORIG 2009-03-25 17:01:15.000000000 +0100 +++ src/misc.c 2009-03-25 17:01:29.000000000 +0100 @@ -274,7 +274,7 @@ resolve_user(const char *user, uid_t *ui struct passwd *pw; *uid = 0; - if (*user) + if (!*user) return FALSE; pw = getpwnam(user); -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

2 3

INCLUDE not working for me :(
by Charles Jennings 01 Apr '09

01 Apr '09

I have implemented the following version: syslog-ng -V syslog-ng 3.0.1 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline-- 3.0#master#93a342dae3a2b0cb15811d0c34ea7f58b3fba14e Compile-Date: Mar 13 2009 16:29:42 Enable-Threads: off Enable-Debug: on Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: off When I try to implement file inclusion, I get an error at the point where I include the file. I essentially cut the section out of the main syslog-ng.conf file, place it into a new file and replace the area cut in the main syslog-ng.conf file with: include "/etc/syslog-ng/syslog-ng-local.conf"; When I do this I get the following error on service start: service syslog-ng start Starting syslog-ng: syntax error in /etc/syslog-ng/syslog-ng.conf at line 114. [FAILED] Charles Jennings | Network Security Engineer "There is one safeguard known generally to the wise, which is an advantage and security to all, but especially to democracies as against despots. What is it? Distrust." Demosthenes (c 384-322 B.C.), Greek orator. Second Philippic, sct. 24 (344 B.C.)

2 6

syslog 3.0 and fra_digits()
by Joe Hansen 01 Apr '09

01 Apr '09

I just installed syslog 3.0 and added fra_digits(3) in my options, and restarted syslog-ng. I still don't see the milliseconds in the logs. I don't want to use ISO format. Can anyone suggest a solution? Thanks, Jo __________________________________________________________________ Yahoo! Canada Toolbar: Search from anywhere on the web, and bookmark your favourite sites. Download it now http://ca.toolbar.yahoo.com.

2 2

syslog-ng using ssl
by Luigi Augello 27 Mar '09

27 Mar '09

Hello some days ago I sent this message ello I try to use ssl ad I have the follow scenario: but just now i not solved. Anyone may help me Tanks Luigi One server (192.168.1.2) with this syslog.ng.conf ########################################### @version:3.0 source s_sk{file("/var/log/messages");}; source s_ssl{ tcp(ip("0.0.0.0") port (1999) tls(key_file("/root/Scaricati/certificati/privkey.pem") cert_file("/root/Scaricati/certificati/cacert.pem")));}; destination d_file{file("/var/log/syslog-ng.log");}; log{source(s_sk);destination(d_file);}; log{source(s_ssl);destination(d_file);}; One client (192.168.1.3) with this syslog.ng.conf ################################################### @version:3.0 source s_sk{file("/var/log/messages");}; destination d_file{file("/var/log/syslog-ng.log");}; destination d_ssl{tcp("192.168.1.2" port (1999) tls(ca_dir("/root/software/ca/")));}; log{source(s_sk);destination(d_file);}; log{source(s_sk);destination(d_ssl);}; I haven't a CA certificate and I use a self-signed certificate created by these instructions opennsl genrsa -out privkey.pem opennsl req -new -x509 -key prixkey.pem -out cacert.pem -days 1095 I follow step by step the instructions on "The syslog-ng Administrators guide " page 58 and so on and I copied the cacert.pem generated in the server in the client and I use ln -s .... When I try to start the server it starts. Though the client doesn't give me any errors it doesn't start. I suppose the certificate may crate some problems. tanks for help Luigi

2 3

[PATCH] autocreate fifo
by Peter Warasin 27 Mar '09

27 Mar '09

Hi list If you define a pipe as log destination, the pipe must exist before syslog starts, otherwise syslog logs that it cannot write to the pipe. That should be fine normally, but if *all* messages go to that pipe syslog will cause a log-loop with those error messages. The attached patch creates the fifo automatically. kind regards peter -- :: e n d i a n :: open source - open minds :: peter warasin :: http://www.endian.com :: peter(a)endian.com

2 1

source file wildcard problems
by Dan Gunter 27 Mar '09

27 Mar '09

Hi, I am having trouble getting the new file wildcard option to work. I am testing it with the following very simple file-to-file configuration: @version: 3.0 options { time_sleep(500); # polling interval, in ms (make this once per second) use_fqdn(yes); # use fully qualified domain names ts_format(iso); # use ISO8601 timestamps # for normal load flush_lines (10); # number of lines to buffer before writing to disk flush_timeout (1000); # 1 second timeout log_fifo_size(100); stats_freq(3600); # number of seconds between syslog-ng internal stats events; these are useful # for ensuring syslog-ng is not getting overloaded }; # Debugging source syslog_ng { internal(); }; destination debug_dest { file("/u/dang/local/var/log/syslog-ng- internal.log" perm(0644) ); }; log { source(syslog_ng); destination(debug_dest); }; # Other source simple_src { file("/u/dang/local/var/log/myfile.log" follow_freq(1) flags(no-parse) program_override("my_log ") ); }; source test_src { file ("/u/dang/local/var/log/test*.log" follow_freq(1) flags(no-parse) program_override("test_log ") ); }; destination test_dest { file ("/u/dang/local/var/log/collected.log" perm(0644) ); }; log { source(simple_src); destination(test_dest); }; log { source(test_src); destination(test_dest); }; The behavior I am seeing is that anything appended to the static file "myfile.log" shows up in "collected.log" a second later. But new files of the pattern "test-1.log", etc. are never forwarded, and if there are existing files of this name at startup they are ignored. The internal log says: 2009-03-25T10:02:20-07:00 host.org syslog-ng[29624]: Follow-mode file source not found, deferring open; filename='/u/dang/local/var/log/ test*.log' 2009-03-25T10:02:20-07:00 host.org syslog-ng[29626]: syslog-ng starting up; version='3.0.1' My syslog-ng version is: -bash-3.1$ syslog-ng -V syslog-ng 3.0.1 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng- ose--mainline--3.0#master#93a342dae3a2b0cb15811d0c34ea7f58b3fba14e Compile-Date: Mar 25 2009 09:08:54 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: off Any help or tips would be appreciated. Thanks, -Dan

4 5

Re: [syslog-ng] Constant syslog-ng startup message
by chris packham 27 Mar '09

27 Mar '09

On Thu, 2009-03-26 at 15:56 -0400, srainville(a)videotron.ca wrote: > syslog-ng keeps logging the following message. I installed it using > the HEAD RPM for Linux RHEL4. Is there a problem with the startup, or > just a message that can be ignored? > > Mar 26 15:30:16 testserver syslog-ng[22090]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:18 testserver syslog-ng[22092]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:20 testserver syslog-ng[22094]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:21 testserver syslog-ng[22095]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:22 testserver syslog-ng[22097]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:23 testserver syslog-ng[22098]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:24 testserver syslog-ng[22099]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:25 testserver syslog-ng[22100]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:26 testserver syslog-ng[22101]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:28 testserver syslog-ng[22103]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:29 testserver syslog-ng[22104]: syslog-ng starting up; > version='3.0.1+binpkg4' That looks like either multiple instances of syslog-ng are being started or its being stopped and started multiple times ('ps | grep syslog-ng' should tell you which). Either way it's probably not good. At best its adding unnecessary system load, at worst its losing messages. Does RHEL4 use upstart or some other special init system that tries to keep things running if they exit? You may see this kind of thing if there was an error in your config file which would cause syslog-ng to exit only to be re-started by init.

3 3