- syslog-ng - lists.balabit.hu

Help on syslog-ng
by FELLMANN Eric (EXT) 20 Jun '08

20 Jun '08

Hello, I have install syslog-ng on solaris 10(machine A],it configured as log proxy server more /etc/syslog-ng/syslog-ng.conf options { chain_hostnames(no); keep_hostname(yes); use_fqdn(yes); log_fifo_size(1000); }; source local { sun-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; filter notdebug { level(info...emerg); }; destination ercmas13.eurocontrol.fr{ udp("ercmas13.eurocontrol.fr" port (514)); }; log { source(local); filter (notdebug); destination(ercmas13.eurocontrol.fr); }; A client (Machine C) on solaris 10 send logs on (Machine A) I say the log on ercmas13 (logs server) A client (Machine B) on redhat 4 send log on (Machine B) I have nothing on the log server I change this information in this files syslog-ng.conf on log proxy server Each possible communication mechanism has a corresponding source driver in syslog-ng. For example, to open a unix socket with SOCK_DGRAM style communication use the driver unix-dgram. The same socket using the SOCK_STREAM style - as used under Linux - is called unix-stream. source local { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; But when i restart le syslog-ng on log proxy server /etc/init.d/syslog-ng start syslog-ng service starting. Error binding socket; addr='AF_UNIX(/dev/log)', error='Address already in use (125)' Error initializing source driver; source='local' What is the problem ? Best regards Eric FELLMANN ____ This message and any files transmitted with it are legally privileged and intended for the sole use of the individual(s) or entity to whom they are addressed. If you are not the intended recipient, please notify the sender by reply and delete the message and any attachments from your system. Any unauthorised use or disclosure of the content of this message is strictly prohibited and may be unlawful. Nothing in this e-mail message amounts to a contractual or legal commitment on the part of EUROCONTROL, unless it is confirmed by appropriately signed hard copy. Any views expressed in this message are those of the sender.

2 1

Syslog-ng on Mac OS X Leopard 10.5.3
by James Lay 19 Jun '08

19 Jun '08

Hey all! Been trying like crazy just to get a simple setup going and I am having a REALLY tough time. Just to test I¹m wanting to make it easy and have EVERYTHING log to /var/log/messages (my line in syslog.conf is ³*.* /var/log/messages² which works quite well). I¹ve gone through and looked online and found one example for OS X ( http://sial.org/howto/logging/syslog-ng/) but it¹s not working..I don¹t get anything in my log files. Can any kind soul help me out here? Thank you. James

2 1

Syslog-ng 2.1 OSE rpm on Suse 10
by Raffaele 13 Jun '08

13 Jun '08

Hi, I'm trying to install syslog-ng 2.1 OSE from balabit precompiled packages and I get this output: #~/syslog-ng # rpm -ivh syslog-ng-2.1beta1-1.i586.rpm error: Failed dependencies: libdbi8.so.0 is needed by syslog-ng-2.1beta1-1.i586 #~/syslog-ng # cat /etc/issue Welcome to SUSE Linux Enterprise Server 10 (i586) - Kernel \r (\l). #~/syslog-ng # uname -a Linux 2.6.16.27-0.9-smp #1 SMP Tue Feb 13 09:35:18 UTC 2007 i686 athlon i386 GNU/Linux Searching on docs seems that libdbi8 is required for PE and not for OSE, am I wrong? Best regards Raffaele

2 3

Ronald Jones is out of the office.
by Ronald Jones 13 Jun '08

13 Jun '08

I will be out of the office starting 06/12/2008 and will not return until 06/16/2008. I will respond to your message when I return. ----------------------------------------- ________________________________________________________ DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

1 0

[Bug 22] New: Incorrect PID macro content
by bugzilla＠bugzilla.balabit.com 10 Jun '08

10 Jun '08

https://bugzilla.balabit.com/show_bug.cgi?id=22 Summary: Incorrect PID macro content Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: kgushtin(a)n-ix.com.ua Type of the Report: --- Estimated Hours: 0.0 I'm working for op5 and we have sometimes this very important to us problem. So, on boot we expirienced incorrect content of $PID macro, that can't be converted to integer. For example PID contains - PCI0, LNKA, LNKD, ... I think the problem is in parser, which parse Log Message that contains brackets [], which shouldn't do this, it needs to parse only Log Header for []. Some more description in my latter on postlist - "Problem with PID macro" (2008-06-10). Example of inccorect message : Feb 25 18:23:34 test-system kernel: ACPI: PCI Root Bridge [PCI0] (0000:00) Some additional info: We saw this in syslog-ng premium edition 2.1.9a, in our build of open source syslog-ng 2.2.0 and in old syslog-ng-2.0.5-op5.1_RHEL5 . I run all the tests on VMWare machine. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

unusual syntax error while parsing .conf file
by Andrej Lobovski 10 Jun '08

10 Jun '08

I upgraded from 1.6.9 ro 2.0.8 but am using same .conf file, which on 1.6.9. works perfectly. The only line that gives me error (but syslog-ng 2.0.8 then works normally if i comment it out) in 2.0.8 is destination d_root { usertty("root" template("$MSGONLY\n")); }; Has this changed? I get syslog-ngsyntax error 273 if I start it. (273 is line in .conf file which i mention in this email). Thank you in advance _________________________________________________________________ Explore the seven wonders of the world http://search.msn.com/results.aspx?q=7+wonders+world&mkt=en-US&form=QBRE

3 3

Problem with PID macro
by Kostyantyn Gushtin 10 Jun '08

10 Jun '08

2 1

windows syslog-mng agent
by James B Horwath 10 Jun '08

10 Jun '08

Does anyone have any experience with the windows syslog-ng agent? If so could you contact me off-line so I could here about your experience. TIA. Jim ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

1 0

file() source, facility, priority and new events only,
by Hari Sekhon 09 Jun '08

09 Jun '08

Hi, I'm using the file() source to include logs from an application that doesn't do syslog (heresy! :-) ). It looks like it's logging the thing under the kern facility. I've been through the admin manual v2 and cannot see any way to change the facility and priority that it marks the source as. My current source looks like this: source s_app_name{ file( "/path/to/app.log" log_prefix("App Name: ") flags(no-parse) ) ; }; Also, the app.log is quite big and syslog-ng has gone and taken the whole thing and inserted it into syslog with the current timestamp. I'd like to know if there is a tail -n 0 type switch to tell it to take only things that have been appended since it has started watching the file. Can this be done? I wrote a script that basically tails to logger which does all these things but I'd rather use the file() source if I can get these niggles working the way I want. I'm running syslog-ng 2.0.6. -h -- Hari Sekhon

2 1

How to skip parsing?
by Clay Loveless 09 Jun '08

09 Jun '08

Hi, I'm relatively new to syslog-ng, but have dug in enough to see that there's an option in 2.0.9 (possibly earlier as well) to skip message parsing that throws off the "unparseable log message" errors. In src/logmsg.c, there's apparently a flag that can be set to skip parsing. (See line 140). I have one particular message source that I'd like to skip parsing on. What I haven't been able to determine is how to configure syslog- ng.conf with the flag that would skip the parsing of the log message. Can anyone help out on this? Thanks, Clay -- Killersoft.com

2 3