- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Syslog-ng - UDP templates
by Paul Robert Marino 10 Sep '08

10 Sep '08

Its avalible in the open source version. There is probably an error in your configuration can you please attach a copy so we can help you. You may replace the ip addresses with xxx.xxx.xxx.xxx if you are concerned with keeping the ip addresses off the list. Also please give us an example of how you would like the message formated. -----Original Message----- From: "Shlayen, Yakov (CAT)" <Yakov.Shlayen(a)AutoTraderPub.com> Subj: Re: [syslog-ng] Syslog-ng - UDP templates Date: Tue Sep 9, 2008 1:24 pm Size: 1K To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Hello, I'm new user for syslog-ng product. I cannot found libdbi8* pkg for Solaris 10. Are you can help me with this? Best regards, Yakov (Jake) Shlayen Unix System Administrator Cox AutoTrader/AutoMart 5909 Peachtree Dunwoody Road Atlanta, GA 30328 Email:yakov.shlayen@autotraderpub.com Phone: 678-645-8227 Mobile: 404-643-3169 -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Thibaud Desodt Sent: Tuesday, September 09, 2008 11:40 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Syslog-ng - UDP templates Hi, I am trying to configure syslog-ng (running on OpenSUSE 11.0) to forward a message to another server through UDP. I would like to modify the message's format, therefore I tried to use "template()" without success. (parsing error while restarting the syslog) The version installed with this distribution is 1.6.12, and from what I understood, the feature is available in later versions (1.6rc3 ?) . Is it available in the OpenSource Edition or only in the Premium Edition ? and where can I find it ? Thanks in advance Thibaud ________________________________________________________________________ ______ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html --- message truncated ---

1 0

Anyone Using Mailgraph (an RRD based Tool) for Postfix Mail Logs???
by wiskbroom＠hotmail.com 08 Sep '08

08 Sep '08

Hello; I am in search for a way to graph my logs for four separate mailservers, since all four are logging onto the same syslog-ng host, I figured I'd use mailgraph, a tool which creates graphs using RRDtools. I got rrdtools installed and ran mailgraph, and after not receiving any graph data at all in my database (mailgraph.rrd file), I ran strace and saw: write(2, "WARNING: line not in syslog form"..., 209) = 209 write(2, "WARNING: line not in syslog form"..., 167) = 167 write(2, "WARNING: line not in syslog form"..., 172) = 172 write(2, "WARNING: line not in syslog form"..., 173) = 173 write(2, "WARNING: line not in syslog form"..., 194) = 194 write(2, "WARNING: line not in syslog form"..., 172) = 172 My syslog-ng.conf has the following relevant data for this particular source: options { chain_hostnames(no); create_dirs (yes); dir_perm(0755); use_dns (yes); dns_cache(yes); dns_cache_size(1000); dns_cache_expire(604800); keep_hostname(yes); log_fifo_size(10000); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(yes); }; log { source(S_udp); filter(F_mailservers); destination(D_mailservers); flags(final); }; destination D_mailservers { file("/var/log/Acme-Hosts/MailServers/$FULLHOST.log" perm(0644)); }; My logs look like: Sep 5 16:31:45 mailserver.example.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 597816CB1E: from=<203176.549962556(a)abc.exampletest.com>, size=14602, nrcpt=1 (queue active) Sep 5 16:31:45 mailserver.mailserver.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 3081A6CB1C: removed Sep 5 16:31:45 mailserver.mailserver.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 1C0426CB1D: removed Is there a way that I can tel syslog-ng to output to two locations, on e in the format above, which I need, and another in the format that mailgraph expexts to see? I assume that mailgraph is not setup to see the HOSTNAME/HOSTNAME entries shown above. I am using syslog-ng, latest, and am purposely stuffing my data into files named after the host, into a directory named after the same. I am also using a FIFO to redirect all logged data into a mysql DB, but the script mailgraph is receiving it's data from the flat files above. Any help appreciated, especially in a way that would not require rewriting the way the data looks now. Thanks all, .vp

2 5

Oracle logging into syslog-ng?
by Surlow, Jim 08 Sep '08

08 Sep '08

Please provide thoughts and comments - I'm not a DBA and I'm having our DBAs do further research here, but ... I infer from the Oracle documentation, that Oracle logs to a single syslog facility+level per instance, if configured. And the information in the Oracle log cannot be configured/altered. The downside that I'm seeing is that there is no information in regards to the Oracle instance. So, if I have a box with 20+ instances and I wish to relay this to a central server, all this is going to end up as noise. My kludge for this, would be to setup the following on each Oracle server: Instance #1 -> local0.debug Instance #2 -> local0.info Instance #3 -> local0.warn Instance #4 -> local1.debug Instance #5 -> local1.info Instance #6 -> local1.warn Etc. Then, setup syslog-ng on that Oracle server to use templates (one per instance), to route the data to a single facility & level on our centralized syslog-ng log server and imbed an instance name into the log. This config sounds really cumbersome. I'm also trying to avoid using Oracle to send the logs to a different instance which would do the consolidation. Does anyone else have a better solution? Am I right in that Oracle will only send to a single facility+level combo regardless of criticality? Thanks, Jim

2 1

Connection failed; error='Connection refused (111)'
by n r 05 Sep '08

05 Sep '08

hi, I intalled syslog-ng on server (debian etch) and on a client (ubuntu) i have this message on the both ??? syslog-ng[2959]: Connection failed; error='Connection refused (111)', time_reopen='10' any help? thanks nr _________________________________________________________________ Découvrez Windows Live Spaces et créez votre site Web perso en quelques clics ! http://spaces.live.com/signup.aspx

1 0

apache logs over syslog-ng sychronized
by Eli Shemer 04 Sep '08

04 Sep '08

Hey there, I would like to know if this configuration sounds viable to you. Right now it's not really operational performance wise. What I'm basically trying to do is to have my syslog server completely synchronized to the apache access logs of my other servers. On a client I have this configured: source s_apachelogs { file("/etc/apache2/logs/test/2008-09-02-test.log"); }; destination df_apachelogs { tcp("192.168.200.4" port(1999)); }; log { source(s_apachelogs); destination(df_apachelogs); }; and on the server: source s_apachelogs { tcp(ip(192.168.200.4) port(1999)); }; destination df_apachelogs { file("/var/log/apachelogs.log"); }; log { source(s_apachelogs); destination(df_apachelogs); }; This is just a sample case. Later on I would like to have my server keep an /var/log/apachelogs/ directory completely identical to the logs of the other servers. For some reason I don't see any traffic passed over the line unless I run a /etc/init.d/syslog-ng reload which is really bizzar. Thanks!

4 9

incorrect port number in stats
by Joe Shaw 04 Sep '08

04 Sep '08

Hi, Another minor thing I've noticed in 2.1.1... the port number in the log statistics for a remote destination is wrong: dropped='tcp(dest-host:514)=0 [...] The syslog-ng daemon is running on port 2000, and the data is correctly being sent there. In 2.0.9, it said instead: dropped='tcp(AF_INET(10.1.73.18:2000))=0' Joe

2 1

syslog-ng 2 nics
by Hubert Kupper 03 Sep '08

03 Sep '08

Hi, we run a SLES10 SP2 server as a syslog-ng server for a couple of month without errors. Now I added a secondary nic in the server an binded a subnet to the nic. The first switch from this subnet logs to syslog-ng fine, but every switch else in this subnet don't create a log-directory on the server. I've run ethereal an see that all switches send their packets to port 514 on the server, but syslog-ng do nothing with this packets. What can be wrong? Regards, Boert -- GMX startet ShortView.de. Hier findest Du Leute mit Deinen Interessen! Jetzt dabei sein: http://www.shortview.de/wasistshortview.php?mc=sv_ext_mf@gmx

2 4

No output to file with 2.1.1
by Joe Shaw 03 Sep '08

03 Sep '08

Hi, I just tried updating to 2.1.1 on my test instance and none of the incoming data is being written out to disk. It worked for me with 2.0.9. The problem is with the log_iw_size() parameter in my tcp source. Without it, the data is being logged to disk. My configuration file is below. Anything obviously amiss? Thanks, Joe -- # General Options options { sync(0); time_reopen(10); log_fifo_size(131072); long_hostnames(off); use_dns(yes); dns_cache(yes); use_fqdn(no); keep_hostname(yes); use_time_recvd(no); #log_msg_size(65536); log_msg_size(16384); stats_freq(180); #time_sleep(20); }; # Remote source source s_tcp { tcp(port(2000) log_iw_size(131072) log_fetch_limit(1024) max_connections(128)); }; # syslog-ng statistics source s_internal { internal(); }; destination d_file { file("/ita/syslog-messages" perm(0644)); }; destination d_stats { file("/ita/syslog-stats" perm(0644)); }; # Save stats separately log { source(s_internal); destination(d_stats); }; # Take all remote data and save it locally log { source(s_tcp); destination(d_file); flags(flow-control); };

2 1

syslog-ng 2.1.1 has been released
by devel＠balabit.hu 02 Sep '08

02 Sep '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.1.1 SUMMARY : new stable release DATE : Sep 2, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.1.1) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.1 Thu, 28 Aug 2008 09:26:30 +0200 Bugfixes: * Fixed a possible crash in stats message generation. * Fixed compilation problem in loggen on FreeBSD. Other changes: * The netmask filter was changed to assume that local messages are received from 127.0.0.1. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.1 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.1 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.1 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.1 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.1 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/

1 0

a question about dns
by liuruihong 02 Sep '08

02 Sep '08

I use syslog-ng to receive remote logs. In the conf of syslog-ng I use 'use_dns(yes)' option . My question is : there is a remote host which has one ip 10.23.245.158,and two dns: build-la21.com and lrh- build-la21.com, which dns will syslog-ng choose when receive logs from the remote host?

1 0