- syslog-ng - lists.balabit.hu

[PATCH] Cygwin: missing colon in default syslog-ng.conf
by Corinna Vinschen 14 Apr '09

14 Apr '09

Hi, The Cygwin service installer script creates a version entry without a colon, which leads to warnings. The below patch fixes that. Please apply. Thanks, Corinna --- contrib/cygwin-packaging/syslog-ng-config.ORIG 2009-03-25 17:08:34.000000000 +0100 +++ contrib/cygwin-packaging/syslog-ng-config 2009-03-19 19:21:34.000000000 +0100 @@ -205,7 +205,7 @@ if [ ! -f "${SYSCONFDIR}/syslog-ng.conf" then echo "Creating default ${SYSCONFDIR}/syslog-ng.conf file" cat > ${SYSCONFDIR}/syslog-ng.conf << EOF -@version 3.0 +@version: 3.0 options { keep_hostname(yes); owner("system"); -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

4 6

Database field types
by Liam Kirsher 14 Apr '09

14 Apr '09

Hi -- I notice that when the database tables get created all the fields are 'text' type. That is okay. However, it might in some cases be convenient for us to have different field types. Is there any problem with that? If we create the table with the desired field types, will that take care of it (assuming the data actually matches the type)? Liam -- Liam Kirsher PGP: http://liam.numenet.com/pgp/

2 7

Solaris 10 x86 configuration not working
by mwilson＠hjf.org 09 Apr '09

09 Apr '09

Hello, I've been using version 2 for a couple of years and decided to upgrade one of my systems to version 3, but my syslog-ng.conf file doesn't seem to work. I can't figure out the error and am hoping someone can give me a hand. Here's the error: # /usr/local/sbin/syslog-ng -v -s -f /etc/syslog-ng/syslog-ng.conf Error parsing command line arguments: Conversion from character set '646' to 'UTF-8' is not supported Here's a sanitized version of my conf file: /etc/syslog-ng/syslog-ng.conf options { stats(0); sync(0); time_reopen(1); log_fifo_size(4096); long_hostnames(off); use_dns(no); use_fqdn(no); create_dirs(yes); keep_hostname(yes); }; source sys { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); tcp(ip("0.0.0.0") port(5150) max-connections(300)); }; filter notdebug { level(info...emerg); }; destination perhost { file("/var/log/perhost/$HOST.log.$YEAR$MONTH$DAY"); }; log { source(sys); filter(notdebug); destination(perhost); }; destination syslogserver { tcp("10.1.1.20" port(5150)); }; log { source(sys); filter(notdebug); destination(syslogserver); }; Any suggestions?

3 3

syslog-ng does notnwrite in the database
by gatfi sami 08 Apr '09

08 Apr '09

i use syslog-ng 2.0 Hi in my syslog-ng server i can write log comming from the client to a file > > source mysrc{ tcp(ip(0.0.0.0) port(514) keep-alive(yes)); > #udp(); > }; > > destination std { > > > file("/var/log/syslog-ng1/$HOST/messages" owner("root") group("root") > perm(0640) dir_perm(0750) create_dirs(yes)); > > }; > > > log {source(mysrc); destination(std);}; > > destination std1 { > udp("192.168.1.66" port(514)); > > }; > #filter my_filter {match("Apache"); }; > > > #log { > # source(mysrc); > # filter(my_filter); > # destination(std); > #}; > > > log { > source(mysrc); > > destination(std1); > }; > > but when i use a pipe destination d_mysql { > pipe("/tmp/mysql.pipe" > template("INSERT INTO logs (host, facility, priority, level, tag, date, > time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', > '$TAG', > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") > template-escape(yes)); > }; > log { source(mysrc); destination(d_mysql); the wired thing is that when i : 1 runed the script that binds the pipe to the database ./mysql.bash& *# !/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u root -D syslog< /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi* 2 created a test sql script request.sql *INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( 'testhost1', 'testfacility1', 'testpriority1', '0','TestTag1', '2009-04-07', '19:00:00', 'Apache', 'Test Message' );* * * ** 3 injected it into the pipe cat request.sql > /tmp/mysql.pipe* * 4 tetsted a *select * from tags; * i found the values on request.sql strange isn't it? so what can i do

1 0

Question about logStore alternative ..
by fredzy padzy 07 Apr '09

07 Apr '09

Hy everyone I'm wondering if it's could be possible to make the same thing that the logStore does (even if it's not as strong as, or as efficient as). Actually, it seems that the PreniumVersion of SyslogNG isn't ready yet for my plateform, and i just though about building a kind of 'homemade' logStore. (but of course, not declared in my syslog-ng.conf ... but acting in my txt log file, in a another directory) I'm using AIDE for a few days, but it doesn't look to handle chunks of file, which Prenium Edition seems to use Moreover, it has to be launched every time a log is written, and i'm pretty sure it will warn about a lot of false positive. any idea ???? bye :)

1 0

problem in writing to database 2
by gatfi sami 05 Apr '09

05 Apr '09

i succefully added the folowing script to /etc/profile it recreates the pilpline but when i get access to the virtual machine by ssh it is blocked like this: Password: *Last login: Sun Apr 5 03:08:51 2009 from linux-ux35.lan Have a lot of fun... *i have to tape ctrl + c to have linux-test1:~ # i have to tape ctrl +c to get access to it here is the script #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u root --password= syslog< /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi i think the problem is from mysql -u root --password= syslog< /tmp/mysql.pipe 2009/4/4 gatfi sami <pfegatfi.sami(a)gmail.com> > hi > > i am configuring a centralised syslog server and when i arrived to the > writing into the database there is some thing wrong > > because when i use a file as destination i see incoming logs when i restart > apache2 or mysql in the client > > "tail - f /" > i use syslog -ng 2.0 > > here is the client > *source my_src{ > file("/var/log/apache2/error_log" follow_freq(1) ); > > file("/var/lib/mysql/mysqld.log" follow_freq(1) ); > > }; > > > destination loghost { > tcp("192.168.1.69" port(514)); > }; > log { > source(my_src); > destination(loghost); > };* > > > > here is the server > > * source mysrc{ tcp(ip(0.0.0.0) port(514) keep-alive(yes)); > #udp(); > }; > > destination d_mysql { > pipe("/tmp/mysql.pipe" > template("INSERT INTO logs (host, facility, priority, level, tag, date, > time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', > '$TAG', > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") > template-escape(yes)); > }; > log { source(mysrc); destination(d_mysql); > }; > * > > note that a databes names syslog is already created and contain a table > logs; > > > > if itry the following command : syslog-ng -f /etc/syslog-ng/syslog-ng.conf > > Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already > in use (98)' > Error initializing source driver; source='mysrc' > > > ps i used to use the server as relai and send by udp using the same port > 514 but now everinthing is > > commented like this # > > need help > i added the following script to the file

1 0

problem in writing to database
by gatfi sami 04 Apr '09

04 Apr '09

hi i am configuring a centralised syslog server and when i arrived to the writing into the database there is some thing wrong because when i use a file as destination i see incoming logs when i restart apache2 or mysql in the client "tail - f /" i use syslog -ng 2.0 here is the client *source my_src{ file("/var/log/apache2/error_log" follow_freq(1) ); file("/var/lib/mysql/mysqld.log" follow_freq(1) ); }; destination loghost { tcp("192.168.1.69" port(514)); }; log { source(my_src); destination(loghost); };* here is the server * source mysrc{ tcp(ip(0.0.0.0) port(514) keep-alive(yes)); #udp(); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(mysrc); destination(d_mysql); }; * note that a databes names syslog is already created and contain a table logs; if itry the following command : syslog-ng -f /etc/syslog-ng/syslog-ng.conf Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already in use (98)' Error initializing source driver; source='mysrc' ps i used to use the server as relai and send by udp using the same port 514 but now everinthing is commented like this # need help

1 0

[PATCH] typo in misc.c, function resolve_user?
by Corinna Vinschen 01 Apr '09

01 Apr '09

Hi, a Cygwin user got a message in the syslog every time the syslog-ng service started up: Error resolving user; user='system' He also found why this message was generated. The function resolve_user() in misc.c appears to have a typo. If the incoming user argument points to a non-empty string, resolve_user() just returns NULL. So, the following getpwnam is only called for an empty user string. This looks like a typo. One possible fix below. However, maybe the intention was actually to test for if (!user) instead of if (!*user) ??? Corinna --- src/misc.c.ORIG 2009-03-25 17:01:15.000000000 +0100 +++ src/misc.c 2009-03-25 17:01:29.000000000 +0100 @@ -274,7 +274,7 @@ resolve_user(const char *user, uid_t *ui struct passwd *pw; *uid = 0; - if (*user) + if (!*user) return FALSE; pw = getpwnam(user); -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

2 3

INCLUDE not working for me :(
by Charles Jennings 01 Apr '09

01 Apr '09

I have implemented the following version: syslog-ng -V syslog-ng 3.0.1 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline-- 3.0#master#93a342dae3a2b0cb15811d0c34ea7f58b3fba14e Compile-Date: Mar 13 2009 16:29:42 Enable-Threads: off Enable-Debug: on Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: off When I try to implement file inclusion, I get an error at the point where I include the file. I essentially cut the section out of the main syslog-ng.conf file, place it into a new file and replace the area cut in the main syslog-ng.conf file with: include "/etc/syslog-ng/syslog-ng-local.conf"; When I do this I get the following error on service start: service syslog-ng start Starting syslog-ng: syntax error in /etc/syslog-ng/syslog-ng.conf at line 114. [FAILED] Charles Jennings | Network Security Engineer "There is one safeguard known generally to the wise, which is an advantage and security to all, but especially to democracies as against despots. What is it? Distrust." Demosthenes (c 384-322 B.C.), Greek orator. Second Philippic, sct. 24 (344 B.C.)

2 6

syslog 3.0 and fra_digits()
by Joe Hansen 01 Apr '09

01 Apr '09

I just installed syslog 3.0 and added fra_digits(3) in my options, and restarted syslog-ng. I still don't see the milliseconds in the logs. I don't want to use ISO format. Can anyone suggest a solution? Thanks, Jo __________________________________________________________________ Yahoo! Canada Toolbar: Search from anywhere on the web, and bookmark your favourite sites. Download it now http://ca.toolbar.yahoo.com.

2 2