- syslog-ng - lists.balabit.hu

redirect output using symbolic links
by Robert Ulbrich 08 May '08

08 May '08

Howdy all! If syslog-ng is configured to send messages to a particular file, which is a symbolic link, and I relink to a new file, do I need to send a HUP signal to syslog-ng before I relink? Thanks! -- ________________________ Robert Ulbrich Software Developer CAPSHER Technology, Inc. (979) 776-7520x150 rulbrich(a)capsher.com ________________________

3 2

Re: [syslog-ng] specify destination filename in message?
by Robert Ulbrich 07 May '08

07 May '08

> > That's the solution you've picked. > I still haven't figured out how to actually do this in the configuration file. > What is the reasoning which lead you to pick this solution? > I am going to be using syslog to log messages from an app I am writing. I need to be able to have the messages start going into a new file at an arbitrary time. > If nothing else, there are significant security and denial of service > issues inherent in this idea, especially when accepting UDP syslog > messages, trivially spoofable. > I am only going to be handling messages from my app, not a catch-all source.

2 2

specify destination filename in message?
by Robert Ulbrich 07 May '08

07 May '08

Howdy All! I am not sure if this is possible with syslog-ng alone, but I thought I would see if any clever minds could conceive a solution ;-). I would like to be able to specify a destination file by putting the filename in the message itself. My thought is that I could include the filename as the file thing in the message and then use some pattern matching/replacement macro in the configuration file to route the message to the proper file. Is this possible? AtDhVaAnNkCsE! -- ________________________ Robert Ulbrich Software Developer CAPSHER Technology, Inc. (979) 776-7520x150 rulbrich(a)capsher.com ________________________

3 3

syslog-ng "include" config option
by Bryan Duff 29 Apr '08

29 Apr '08

In 2.0.x this doesn't appear to be an option: // in /etc/syslog-ng/syslog-ng.conf include /path/to/syslog-ng/confs/*.conf // end snip I found this debated on the ml some time ago: https://lists.balabit.hu/pipermail/syslog-ng/2002-March/003094.html And that's pretty much what I want, but it was never implemented it seems. Or did I miss something? -Bryan

2 1

Syslog-Ng MySQL Performance Problem
by Hari Sekhon 29 Apr '08

29 Apr '08

Hi, I've had a Syslog-NG Central Logserver -> MySQL setup for nearly 2 years now but am finding it has developed a performance problem with a backed up pipe so I'm thinking of using batched inserts to try to improve the db processing performance. Before I go and code this myself, are there any good generic solutions, somebody must have done this batched inserts before, I saw something on the mailing list once I think but can't see it now... Any other suggestions would also be welcome before I go off and do this. Thanks -h -- Hari Sekhon

3 2

Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4
by Ivey, Chris 25 Apr '08

25 Apr '08

That is interesting, Evan! I did as you suggested (put the env AND the configure on the same command line) and it worked swimmingly... I don't really understand the "why", but I can't argue with the results. :o) For clarification sake, here is what I was doing before that did not work: 1.) PKG_CONFIG_PATH=/usr/local/lib/pkgconfig; export PKG_CONFIG_PATH 2.) sudo ./configure --enable-spoof-source Can someone tell me what the difference between that, and Evan's command below, would be? Thanks everyone, especially Evan and ScottO! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst 1120 Celebration Blvd. Celebration, FL 34747 (321) 939-6540 Office 8296-6540 Disney Tie-Line (407) 557-1072 Cell 162*326905*19 Nextel Direct Connect chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Rempel Sent: Friday, April 25, 2008 1:21 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 >> the output from the configure command: >> >> sudo ./configure --enable-spoof-source >> ... >> checking for pkg-config... /usr/bin/pkg-config >> checking pkg-config is at least version 0.9.0... yes >> checking for GLIB... yes >> checking for EVTLOG... no >> configure: error: Cannot find eventlog version >= 0.2: is pkg-config in >> path? Note that the configure is using /usr/bin/pkg-config and your eventlog.pc is in /usr/local/lib/pkgconfig You need to set the PKG_CONFIG_PATH prior to running the .configure script so that this path gets built into the make process. I use env PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./configure --enable-spoof-source to get the guild right. Evan. >> >> I found the command the configure script runs, so I ran it manaully: >> >> sudo /usr/bin/pkg-config --exists --print-errors eventlog >> Package eventlog was not found in the pkg-config search path. >> Perhaps you should add the directory containing `eventlog.pc' >> to the PKG_CONFIG_PATH environment variable >> No package 'eventlog' found >> >> env | grep PKG >> PKG_CONFIG_PATH=/usr/local/lib/pkgconfig >> >> ls -al /usr/local/lib/pkgconfig/ >> -rw-r--r-- 1 root root 237 Apr 25 08:19 eventlog.pc >> >> Can anyone help me figure this issue out? Thanks in advance! >> >> Chris Ivey >> >> Affiliated Computer Services >> Enterprise Management Integration Services >> Infrastructure Management Senior Analyst >> >> chris.ivey(a)acs-inc.com >> >> "I have not failed, I have simply found 10,000 ways which do not work!" -- >> Thomas Edison >> "When you find yourself in a hole, the best thing to do is stop digging!" > -- >> Nick Stokes >> "I reject your reality, and substitute my own!" -- Adam Savage >> >> >> _____ >> >> From: syslog-ng-bounces(a)lists.balabit.hu >> [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO >> Sent: Wednesday, April 23, 2008 9:36 AM >> To: Syslog-ng users' and developers' mailing list >> Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 >> >> >> Those version numbers should obviously updated to the latest available, :) >> >> >> On Wed, Apr 23, 2008 at 9:35 AM, ScottO <skippylou(a)gmail.com >> <mailto:skippylou@gmail.com> > wrote: >> >> >> On various versions of CentOS and Fedora, all I do is: >> >> - ./configure;make;make install on eventlog-0.2.5.tar.gz (from syslog-ng >> site) >> - export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig >> - ./configure;make;make install on syslog-ng-2.0.5.tar.gz (from syslog-ng >> site) >> >> I did also need to install the glib2-devel package, which I didn't have >> already installed. >> >> Hope that helps, >> >> Scott >> >> >> On Wed, Apr 23, 2008 at 8:36 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com >> <mailto:Chris.ivey@acs-inc.com> > wrote: >> >> >> Hi folks! I posted this question previously, but I am still not clear on >> the process involved in putting a newer version of syslog-ng on my Fedora >> Core 4 machines. I need to upgrade, because my version (1.6.11) does not >> support hi-res timestamps. Can anyone provide some guidance as to how to > go >> about this process? I got information previously to compile from source, >> but I am not 100% clear on the process. Any guidance from you fine folks >> would be terribly appreciated!!! Thanks, folks! >> >> Chris Ivey >> >> Affiliated Computer Services >> Enterprise Management Integration Services >> Infrastructure Management Senior Analyst >> >> chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> >> >> "I have not failed, I have simply found 10,000 ways which do not work!" -- >> Thomas Edison >> "When you find yourself in a hole, the best thing to do is stop digging!" > -- >> Nick Stokes >> "I reject your reality, and substitute my own!" -- Adam Savage >> >> >> > ____________________________________________________________________________ >> __ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng >> <http://www.balabit.com/support/documentation/?product=syslog-ng> >> FAQ: http://www.campin.net/syslog-ng/faq.html >> <http://www.campin.net/syslog-ng/faq.html> >> >> >> >> >> >> >> > ____________________________________________________________________________ > __ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4
by Ivey, Chris 25 Apr '08

25 Apr '08

Thanks, Evan, for the reply. I am already using bash as my shell, so I know that's not it. Thanks anyways, though! Any other thoughts? Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Rempel Sent: Friday, April 25, 2008 10:20 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 Which shell ar you using? in some shells (csh and tcsh) the env is NOT propogated to children. in those you need to setenv PKG_CONFIG_PATH or you chould just use bash to start with. Evan. On Fri, 25 Apr 2008, Ivey, Chris wrote: > Date: Fri, 25 Apr 2008 08:50:35 -0500 > From: "Ivey, Chris" <Chris.ivey(a)acs-inc.com> > Reply-To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> > Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 > > Scott et. al., > > OK, I am following along with the directions from the "compile > syslog-ng" page but am getting errors. I have seen TONS of posts about > folks having this error, but I have not found a solution. Here is a snip of > the output from the configure command: > > sudo ./configure --enable-spoof-source > ... > checking for pkg-config... /usr/bin/pkg-config > checking pkg-config is at least version 0.9.0... yes > checking for GLIB... yes > checking for EVTLOG... no > configure: error: Cannot find eventlog version >= 0.2: is pkg-config in > path? > > I found the command the configure script runs, so I ran it manaully: > > sudo /usr/bin/pkg-config --exists --print-errors eventlog > Package eventlog was not found in the pkg-config search path. > Perhaps you should add the directory containing `eventlog.pc' > to the PKG_CONFIG_PATH environment variable > No package 'eventlog' found > > env | grep PKG > PKG_CONFIG_PATH=/usr/local/lib/pkgconfig > > ls -al /usr/local/lib/pkgconfig/ > -rw-r--r-- 1 root root 237 Apr 25 08:19 eventlog.pc > > Can anyone help me figure this issue out? Thanks in advance! > > Chris Ivey > > Affiliated Computer Services > Enterprise Management Integration Services > Infrastructure Management Senior Analyst > > chris.ivey(a)acs-inc.com > > "I have not failed, I have simply found 10,000 ways which do not work!" -- > Thomas Edison > "When you find yourself in a hole, the best thing to do is stop digging!" -- > Nick Stokes > "I reject your reality, and substitute my own!" -- Adam Savage > > > _____ > > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO > Sent: Wednesday, April 23, 2008 9:36 AM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 > > > Those version numbers should obviously updated to the latest available, :) > > > On Wed, Apr 23, 2008 at 9:35 AM, ScottO <skippylou(a)gmail.com > <mailto:skippylou@gmail.com> > wrote: > > > On various versions of CentOS and Fedora, all I do is: > > - ./configure;make;make install on eventlog-0.2.5.tar.gz (from syslog-ng > site) > - export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig > - ./configure;make;make install on syslog-ng-2.0.5.tar.gz (from syslog-ng > site) > > I did also need to install the glib2-devel package, which I didn't have > already installed. > > Hope that helps, > > Scott > > > On Wed, Apr 23, 2008 at 8:36 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com > <mailto:Chris.ivey@acs-inc.com> > wrote: > > > Hi folks! I posted this question previously, but I am still not clear on > the process involved in putting a newer version of syslog-ng on my Fedora > Core 4 machines. I need to upgrade, because my version (1.6.11) does not > support hi-res timestamps. Can anyone provide some guidance as to how to go > about this process? I got information previously to compile from source, > but I am not 100% clear on the process. Any guidance from you fine folks > would be terribly appreciated!!! Thanks, folks! > > Chris Ivey > > Affiliated Computer Services > Enterprise Management Integration Services > Infrastructure Management Senior Analyst > > chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> > > "I have not failed, I have simply found 10,000 ways which do not work!" -- > Thomas Edison > "When you find yourself in a hole, the best thing to do is stop digging!" -- > Nick Stokes > "I reject your reality, and substitute my own!" -- Adam Savage > > > ____________________________________________________________________________ > __ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://lists.balabit.hu/mailman/listinfo/syslog-ng> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <http://www.balabit.com/support/documentation/?product=syslog-ng> > FAQ: http://www.campin.net/syslog-ng/faq.html > <http://www.campin.net/syslog-ng/faq.html> > > > > > > > ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4
by Ivey, Chris 25 Apr '08

25 Apr '08

Scott et. al., OK, I am following along with the directions from the "compile syslog-ng" page but am getting errors. I have seen TONS of posts about folks having this error, but I have not found a solution. Here is a snip of the output from the configure command: sudo ./configure --enable-spoof-source ... checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... no configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? I found the command the configure script runs, so I ran it manaully: sudo /usr/bin/pkg-config --exists --print-errors eventlog Package eventlog was not found in the pkg-config search path. Perhaps you should add the directory containing `eventlog.pc' to the PKG_CONFIG_PATH environment variable No package 'eventlog' found env | grep PKG PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ls -al /usr/local/lib/pkgconfig/ -rw-r--r-- 1 root root 237 Apr 25 08:19 eventlog.pc Can anyone help me figure this issue out? Thanks in advance! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO Sent: Wednesday, April 23, 2008 9:36 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 Those version numbers should obviously updated to the latest available, :) On Wed, Apr 23, 2008 at 9:35 AM, ScottO <skippylou(a)gmail.com <mailto:skippylou@gmail.com> > wrote: On various versions of CentOS and Fedora, all I do is: - ./configure;make;make install on eventlog-0.2.5.tar.gz (from syslog-ng site) - export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig - ./configure;make;make install on syslog-ng-2.0.5.tar.gz (from syslog-ng site) I did also need to install the glib2-devel package, which I didn't have already installed. Hope that helps, Scott On Wed, Apr 23, 2008 at 8:36 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com <mailto:Chris.ivey@acs-inc.com> > wrote: Hi folks! I posted this question previously, but I am still not clear on the process involved in putting a newer version of syslog-ng on my Fedora Core 4 machines. I need to upgrade, because my version (1.6.11) does not support hi-res timestamps. Can anyone provide some guidance as to how to go about this process? I got information previously to compile from source, but I am not 100% clear on the process. Any guidance from you fine folks would be terribly appreciated!!! Thanks, folks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

2 1

how to change localhost to hostname
by D'Souza, Alfred 24 Apr '08

24 Apr '08

We have a bunch of servers whose applications write error/debug messages to 127.0.0.1 port 514. We want syslog-ng on each of the servers to forward the messages to a central logging server which also forwards the messages to zenoss running on the central logger server. The problem with our configuration (which I have copied here) is that no matter which server originates the message, they show up on the central server as originating from localhost - in both zenoss and in the /var/log files We want them to be shown as originating from the server that produced the messages. We can add a template on the central logger to log the messages as coming form $FROM_HOST, but while that solves the problem for the /var/log messages, zenoss still shows the messages as coming from localhost. Please help, we are new to using syslog-ng. We are using syslog-ng version 2.0.8 on Red Hat Linux. -----------------server syslog-ng.conf (slightly abbreviated) options { use_dns(yes); use_fqdn(no); chain_hostnames(no); keep_hostnames(yes); ::: }; source java { udp(ip(127.0.0.1) port(514)); }; destination remote { udp("192.168.99.105" port(514)); } log { source(java); destination(remote); }; ------------------central logger config file options { use_time_recvd( no ); time_reopen(1); long_hostnames(off); sync(0); use_dns(yes); use_fqdn(no); chain_hostnames(no); keep_hostname(yes); create_dirs(yes); stats(3600); }; source src { unix-stream("/dev/log"); pipe("/proc/kmsg"); internal(); udp(ip(0.0.0.0) port(514)); }; destination everything { file("/var/log/$HOST_FROM.$MONTH$DAY$YEAR" template("$HOST_FROM $HOUR:$MIN:$SEC $MSG\n")); }; destination zenoss { udp( "localhost" port(5514) ); #udp( "localhost" port(5514) template("<$PRI>$DATE $HOST_FROM $MSG\n") ); }; log { source(src); destination(everything); }; log { source(src); destination(zenoss); }; PLEASE READ: This message is for the named person's use only. It may contain confidential, proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please delete it and all copies from your system, destroy any hard copies and notify the sender. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. Nomura Holding America Inc., Nomura Securities International, Inc, and their respective subsidiaries each reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorized to state the views of such entity. Unless otherwise stated, any pricing information in this message is indicative only, is subject to change and does not constitute an offer to deal at any price quoted. Any reference to the terms of executed transactions should be treated as preliminary only and subject to our formal written confirmation.

3 2

Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4
by Ivey, Chris 23 Apr '08

23 Apr '08

Thank you, Scott! I appreciate your assistance. I will take your guidance below, and start working on getting the latest syslog-ng working on my macines. Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO Sent: Wednesday, April 23, 2008 9:36 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 Those version numbers should obviously updated to the latest available, :) On Wed, Apr 23, 2008 at 9:35 AM, ScottO <skippylou(a)gmail.com <mailto:skippylou@gmail.com> > wrote: On various versions of CentOS and Fedora, all I do is: - ./configure;make;make install on eventlog-0.2.5.tar.gz (from syslog-ng site) - export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig - ./configure;make;make install on syslog-ng-2.0.5.tar.gz (from syslog-ng site) I did also need to install the glib2-devel package, which I didn't have already installed. Hope that helps, Scott On Wed, Apr 23, 2008 at 8:36 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com <mailto:Chris.ivey@acs-inc.com> > wrote: Hi folks! I posted this question previously, but I am still not clear on the process involved in putting a newer version of syslog-ng on my Fedora Core 4 machines. I need to upgrade, because my version (1.6.11) does not support hi-res timestamps. Can anyone provide some guidance as to how to go about this process? I got information previously to compile from source, but I am not 100% clear on the process. Any guidance from you fine folks would be terribly appreciated!!! Thanks, folks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0