- syslog-ng - lists.balabit.hu

Problem in remote logging
by Gemi 27 Jun '08

27 Jun '08

Hi, I am facing problem in remote logging though is working very fine locally. please advise me what to do and where I am missing something. the details I am giving below. I have one target linux system (set top box) and one host Linux Desktop Machine. the syslogd and logging working fine on both target as well as on PC(host) machine individually . I have scenario, I have to run program on target machine. And I have to collect the log on PC(host) console as well as in some file say /tmp/log. I have started $syslogd -r on both the machines. the syslog.conf file on the machines are like this. target >> syslong.conf local0.* @ip.address PC(host) >> syslog.conf local0.err /dev/console local0.* /tmp/log in process list syslogd shows like "syslogd -r" I have already run many times $ kill -SIGHUP /var/run/syslog.pid on both machine. even though it is not working -Gemi _________________________________________________________________ Tried the new MSN Messenger? It’s cool! Download now. http://messenger.msn.com/Download/Default.aspx?mkt=en-in

1 0

Logging timezone info in each message for V 1.6.8
by Manju Ramanathpura (mramanat) 27 Jun '08

27 Jun '08

Hello, Wondering if there is a way to print timezone with each message in the Version 1.6.8 ? Currently my message looks something like below Jan 21 12:22:12 <rest of the message> Instead I would like to see something like below Jan 21 12:22:12 PDT 2008 <rest of the message> or something in that line where I can see the timezone info. I have come across some timezone handling documents from - http://www.syslog.org/syslog-ng/v2/#timezone_handling But only for the Version 2.x and not for version 1.6.X I'd appreciate if you can share any tips for printing timezone ( or perhaps ISO format timestamp ) in each message for V 1.6.8 Thanks, -Manju

2 1

suitability of syslog-ng with long messages
by Joe Shaw 24 Jun '08

24 Jun '08

Hi, I am working on a project in which we will have many gigabytes of data logged per day. The log producers themselves were mostly developed in house and presently are simply logging to a file, but as we build out the system we'll obviously need some centralization. I've been thinking about using syslog-ng for this. While most of the messages are relatively small -- on the order of hundreds of bytes or a couple kilobytes -- there are some exceptional cases where we are generating messages that could be as large as two megabytes and need these to be kept in tact. We'll be using the tcp() destination driver. Are there any performance considerations, gotchas, etc. in setting log_msg_size(2097152)? Would that have a bad interaction memory usage-wise, for example, with log_fifo_size() if it were set to 1000? I am trying to get a feel if syslog-ng is the right tool for the problem here, or if something else would be more suitable. Thanks for any info you can provide, Joe

2 3

Help on syslog-ng
by FELLMANN Eric (EXT) 20 Jun '08

20 Jun '08

Hello, I have install syslog-ng on solaris 10(machine A],it configured as log proxy server more /etc/syslog-ng/syslog-ng.conf options { chain_hostnames(no); keep_hostname(yes); use_fqdn(yes); log_fifo_size(1000); }; source local { sun-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; filter notdebug { level(info...emerg); }; destination ercmas13.eurocontrol.fr{ udp("ercmas13.eurocontrol.fr" port (514)); }; log { source(local); filter (notdebug); destination(ercmas13.eurocontrol.fr); }; A client (Machine C) on solaris 10 send logs on (Machine A) I say the log on ercmas13 (logs server) A client (Machine B) on redhat 4 send log on (Machine B) I have nothing on the log server I change this information in this files syslog-ng.conf on log proxy server Each possible communication mechanism has a corresponding source driver in syslog-ng. For example, to open a unix socket with SOCK_DGRAM style communication use the driver unix-dgram. The same socket using the SOCK_STREAM style - as used under Linux - is called unix-stream. source local { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); internal(); }; But when i restart le syslog-ng on log proxy server /etc/init.d/syslog-ng start syslog-ng service starting. Error binding socket; addr='AF_UNIX(/dev/log)', error='Address already in use (125)' Error initializing source driver; source='local' What is the problem ? Best regards Eric FELLMANN ____ This message and any files transmitted with it are legally privileged and intended for the sole use of the individual(s) or entity to whom they are addressed. If you are not the intended recipient, please notify the sender by reply and delete the message and any attachments from your system. Any unauthorised use or disclosure of the content of this message is strictly prohibited and may be unlawful. Nothing in this e-mail message amounts to a contractual or legal commitment on the part of EUROCONTROL, unless it is confirmed by appropriately signed hard copy. Any views expressed in this message are those of the sender.

2 1

Syslog-ng on Mac OS X Leopard 10.5.3
by James Lay 19 Jun '08

19 Jun '08

Hey all! Been trying like crazy just to get a simple setup going and I am having a REALLY tough time. Just to test I¹m wanting to make it easy and have EVERYTHING log to /var/log/messages (my line in syslog.conf is ³*.* /var/log/messages² which works quite well). I¹ve gone through and looked online and found one example for OS X ( http://sial.org/howto/logging/syslog-ng/) but it¹s not working..I don¹t get anything in my log files. Can any kind soul help me out here? Thank you. James

2 1

Syslog-ng 2.1 OSE rpm on Suse 10
by Raffaele 13 Jun '08

13 Jun '08

Hi, I'm trying to install syslog-ng 2.1 OSE from balabit precompiled packages and I get this output: #~/syslog-ng # rpm -ivh syslog-ng-2.1beta1-1.i586.rpm error: Failed dependencies: libdbi8.so.0 is needed by syslog-ng-2.1beta1-1.i586 #~/syslog-ng # cat /etc/issue Welcome to SUSE Linux Enterprise Server 10 (i586) - Kernel \r (\l). #~/syslog-ng # uname -a Linux 2.6.16.27-0.9-smp #1 SMP Tue Feb 13 09:35:18 UTC 2007 i686 athlon i386 GNU/Linux Searching on docs seems that libdbi8 is required for PE and not for OSE, am I wrong? Best regards Raffaele

2 3

Ronald Jones is out of the office.
by Ronald Jones 13 Jun '08

13 Jun '08

I will be out of the office starting 06/12/2008 and will not return until 06/16/2008. I will respond to your message when I return. ----------------------------------------- ________________________________________________________ DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

1 0

[Bug 22] New: Incorrect PID macro content
by bugzilla＠bugzilla.balabit.com 10 Jun '08

10 Jun '08

https://bugzilla.balabit.com/show_bug.cgi?id=22 Summary: Incorrect PID macro content Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: kgushtin(a)n-ix.com.ua Type of the Report: --- Estimated Hours: 0.0 I'm working for op5 and we have sometimes this very important to us problem. So, on boot we expirienced incorrect content of $PID macro, that can't be converted to integer. For example PID contains - PCI0, LNKA, LNKD, ... I think the problem is in parser, which parse Log Message that contains brackets [], which shouldn't do this, it needs to parse only Log Header for []. Some more description in my latter on postlist - "Problem with PID macro" (2008-06-10). Example of inccorect message : Feb 25 18:23:34 test-system kernel: ACPI: PCI Root Bridge [PCI0] (0000:00) Some additional info: We saw this in syslog-ng premium edition 2.1.9a, in our build of open source syslog-ng 2.2.0 and in old syslog-ng-2.0.5-op5.1_RHEL5 . I run all the tests on VMWare machine. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

unusual syntax error while parsing .conf file
by Andrej Lobovski 10 Jun '08

10 Jun '08

I upgraded from 1.6.9 ro 2.0.8 but am using same .conf file, which on 1.6.9. works perfectly. The only line that gives me error (but syslog-ng 2.0.8 then works normally if i comment it out) in 2.0.8 is destination d_root { usertty("root" template("$MSGONLY\n")); }; Has this changed? I get syslog-ngsyntax error 273 if I start it. (273 is line in .conf file which i mention in this email). Thank you in advance _________________________________________________________________ Explore the seven wonders of the world http://search.msn.com/results.aspx?q=7+wonders+world&mkt=en-US&form=QBRE

3 3

Problem with PID macro
by Kostyantyn Gushtin 10 Jun '08

10 Jun '08

2 1