- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Log to postgres
by ml＠bortal.de 02 Oct '08

02 Oct '08

Hello, I just tried to get syslog-ng 2.1.1 working by doing: #/usr/local/src/libdbi8-0.8.2bb2# make install --> Libraries have been installed in: /usr/local/lib #/usr/local/src/libdbi8-drivers-0.8.2bb3# ./configure --with-pgsql --with-dbi-libdir=/usr/local/lib --disable-docs --> configure: error: Invalid libdbi directory - include files not found. What am i doing wrong? Thanks, Mario

2 1

Log to postgres
by ml＠bortal.de 02 Oct '08

02 Oct '08

Hello List, is there a open-source way to log to a postgres database nativly? We have problems using a pipe. Is is beeing described on page 107 of the syslog-ng Admin Guid but i am not sure if this is only available for the commercial version. Thanks, Mario

2 1

Reload does not free up RAM
by Evan Rempel 02 Oct '08

02 Oct '08

We have cases where a syslog-ng buffers quite a bit of data (2GB or so) before it is able to flush the data to the destination. Currently, the only way to "free up" that RAM is to restart syslog-ng, which means that some log messages are lost during the restart window. I open for discussion the idea that on a reload that syslog-ng flush and free all buffer space and essentially start from a "just started" state again. Comments?

2 1

Re: [syslog-ng] escaping \[ not respected
by Len Conrad 02 Oct '08

02 Oct '08

>Hello, > >> targeted string is "unknown[a.b.c.d]" >> >> my filter: >> >> filter f_conn_from_unk_private { not match >> ("unknown\[(10\.1\.|10\.2\.|10\.10\.5\.|192\.168\.200)"); }; >> >> error: >> >> Error compiling regular expression; >> re='[(10.1.|10.2.|10.10.5.|192.168.200)', error='brackets ([ >]) not balanced' > >I can't confirm this behaviour, as the following does work for me: > >filter f_internal_statistics { > match("^syslog-ng\[[[:digit:]]+.: STATS") or match ("^syslog-ng\[[[:digit:]]+\]: Log statistics"); >}; > >What syslog-ng version are you using? Mine is 2.0.9 Installed with FreeBSD pkg_add from freshports.org, pkg_info shows: "syslog-ng2-2.0.9_1 A powerful syslogd replacement" I conclude that I've found a bug in the parsing of the escape sequence "\[" , and will look for a work around. thanks, Len ______________________________________________ IMGate OpenSource Mail Firewall www.IMGate.net

5 5

$MSGONLY bad output
by Steven 01 Oct '08

01 Oct '08

Hi there, As I can't find this on the web, I'm asking here : I'm receiving the IIS servers logs through my LAN and syslog-ng writes everything to a local files, that is parsed during the night by awstats. The only thing is I can't have syslog-ng to write raw logs to files, it absolutely has to write something (either with $MSG or $MESSAGE). I even tried with $MSGONLY but now I get the opposite problem, it truncates data ! $MSG : IISWebLog 0 2008-09-30 14:02:40 GET /Localized/fr/Images/New2/tlogo.gif - 95.35.41.243 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.0;+SLCC1;+.NET+CLR+2.0.50727 ;+Media+Center+PC+5.0;+.NET+CLR+3.0.04506;+InfoPath.2) http://mypublicwebsite/home/regf 200 2185 With $MSGONLY, I'll get : 02:40 GET /Localized/fr/Images/New2/tlogo.gif - 95.35.41.243 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.0;+SLCC1;+.NET+CLR+2.0.50727 ;+Media+Center+PC+5.0;+.NET+CLR+3.0.04506;+InfoPath.2) http://mypublicwebsite/home/regf 200 2185 Here is my very simple template : template t_IIS { template("$MESSAGE\n"); template_escape(no); }; Destination and filter : destination df_ mypublicwebsite _IISWebLog { file("/data/syslog/mypublicwebsite/IISWebLog" template(t_IIS)); }; filter f_ mypublicwebsite _IISWebLog {(host("^192\.168\.117\.131$") or host("^192\.168\.117\.132$") or host("^192\.168\.117\.133$") or host("^192\.168\.117\.134$") or host("^192\.168\.117\.135$") ) and facility(local4) and program("IISWebLog"); }; log { source(s_net); filter(f_ mypublicwebsite _IISWebLog); destination(df_ mypublicwebsite _IISWebLog); }; # uname -a Linux TR-ADM 2.6.18-4-amd64 #1 SMP Fri May 4 00:37:33 UTC 2007 x86_64 GNU/Linux Anything I'm missing ? Any help would be greatly appreciated. Best regards Steven

3 4

separe files question
by Mártha Csaba 01 Oct '08

01 Oct '08

Hello I have a question, i get logfiles from facility0, with these matter: AppID(0-9a-Z)-ThreadID(0-9a-Z)-DATE-TIME-MESSAGE i created a filter, with this content: filter f_flash_msg { match ("[0-9a-zA-Z]+-[0-9a-zA-Z]-*"); }; and destination destination df_out { file("/var/log/client/flashlog/$1/$2/$YEAR/$MONTH/ $DAY/$TIME.txt"); }; i need separate folders/files. the log line contains these datas: 1234-ABCD-2008-09-30-16-20-35-FatalError AppID-Thread-Date-Time-MSG i need this structure: /var/log/syslog-ng/flashlogs/1234/ABCD/2008/09/30/16.txt what is my mistake? Best Regards Csaba

2 2

escaping \[ not respected
by Len Conrad 01 Oct '08

01 Oct '08

targeted string is "unknown[a.b.c.d]" my filter: filter f_conn_from_unk_private { not match ("unknown\[(10\.1\.|10\.2\.|10\.10\.5\.|192\.168\.200)"); }; error: Error compiling regular expression; re='[(10.1.|10.2.|10.10.5.|192.168.200)', error='brackets ([ ]) not balanced' Len ______________________________________________ IMGate OpenSource Mail Firewall www.IMGate.net

2 1

Trouble with logging to mysql
by Stallmann, Andreas 30 Sep '08

30 Sep '08

Hi there, I'm trying to let syslog-ng log to a mysql database, which is somehow not working (anymore). All my network traffic is supposed to be written into a separate logfile as well as into a mysql database. I followed the HowTo on http://gentoo-wiki.com/HOWTO_setup_PHP-Syslog-NG#Syslog-ng_INIT_Script, and altered the configuration to fit my needs. Here it comes: ############################################ source net { udp(ip("0.0.0.0") port(514)); }; destination d_mysql { program("/usr/bin/mysql --reconnect -f -T --user=syslogfeeder --password=PASSWORD syslog >> /var/log/db_log.log 2>&1" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n") template-escape(yes)); }; destination netmessages { file("/var/log/net.log"); }; log { source(net); destination(netmessages); }; log { source(net); destination(d_mysql); }; ############################################## Thing is, logging to the file works nicely. Logging to the database worked up to some date, but since a while (and no one knows exactly since when, because nobody had a look at the database for some time) it doesn't. This might be connected with a system update. I can provide you with information on the versions (the OS is SLES 10.0, all packages come from the standard source; no self-compiled packages installed) of syslog and mysql as soon as I have access to the customers machine again. I'm looking for a sensible way to debug syslog. Running syslog-ng in the foreground didn't help, I can't see any messages related to logging to mysql. It seems that the destination is never touched. Isn't it possible to log on source to two destinations (anymore)? (I think commented out logging to netmessages, but it still didn't work.) Any comments and hints will be helpful. Even RTFM if you point me to a comprehendible one. :-) TNX, Andreas -- CONET Solutions GmbH Andreas Stallmann, Senior Berater Theodor-Heuss-Allee 19, 53773 Hennef Tel.: +49 2242-939-677, Fax: +49 2242-939-393 Internet: http://www.conet.de, mailto: astallmann(a)conet.de ----------------------------------- CONET Solutions GmbH, Theodor-Heuss-Allee 19, 53773 Hennef Registergericht/Registration Court: Amtsgericht Siegburg (HRB Nr. 9136) Geschaftsfuhrer/Managing Directors: Dipl.-Inform. Rudiger Zeyen (Sprecher/Chairman), Dipl.-Betriebsw. Wilfried Putz und Dipl.-Inform. Jurgen Zender Vorsitzender des Aufsichtsrates/Chairman of the Supervisory Board: Dipl.-Math. Hans-Jurgen Niemeier

4 9

problems doing host based logging with local facility
by Daniel I. Didier 30 Sep '08

30 Sep '08

Hello, I've been working on setting up a syslog to do some event per second calculations. I'm trying to log all information from a host such as AIX or Linux to a single file. I can do this with the 'host' option but I am having problems combining this with the local facility option. I've been working with various iterations but here are the major components: options { sync(0); time_reopen(10); log_fifo_size(1000); long_hostnames(off); use_dns(no); use_fqdn(no); create_dirs(yes); keep_hostname(yes); owner(root); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; source s_net { udp(); }; And here is an example of the log definitions: destination sw-089 { file("/var/log/sw-089.log"); }; destination adm1r2 { file("/var/log/adm1r2.log"); }; filter f_adm1r2 { host("172.16.148.60"); }; filter f_sw-089 { facility(local4); }; log { source(s_sys); filter(f_sw-089); destination(sw-089); }; log { source(s_net); filter(f_adm1r2); destination (adm1r2); }; The facility locals seem to be working at all times, but the host does not... any ideas or suggestions? Thanks, Dan

1 0

Syslog-ng - UDP templates
by Thibaud Desodt 26 Sep '08

26 Sep '08

Hi, I am trying to configure syslog-ng (running on OpenSUSE 11.0) to forward a message to another server through UDP. I would like to modify the message's format, therefore I tried to use "template()" without success. (parsing error while restarting the syslog) The version installed with this distribution is 1.6.12, and from what I understood, the feature is available in later versions (1.6rc3 ?) . Is it available in the OpenSource Edition or only in the Premium Edition ? and where can I find it ? Thanks in advance Thibaud

5 6