- syslog-ng - lists.balabit.hu

spams
by Balazs Scheidler 27 Nov '07

27 Nov '07

Hi, We've had a minor spam issue, but I supposedly fixed it, so no more spam messages should be posted here. -- Bazsi

1 0

Confirm bre1tling 0rder 2980038
by Priscilla Shipman 27 Nov '07

27 Nov '07

Hello, We have brand new model of r0lex yachtmaster II from 2008 for only $229. 15% off only in November. V1sit us n0w at: http://www.spokkilee.com/

1 0

syslog-ng's enigmatic logging behavior ?
by Eiji Inatsu 27 Nov '07

27 Nov '07

Hello, I encoutered a problem about message filtering or macro or ???. I want to fix this problem. please help me. [env] # uname -a SunOS hogehoge 5.10 Generic_125100-07 sun4u sparc SUNW,Sun-Fire-V245 # syslog-ng -V syslog-ng 2.0.2 [conf] # cat syslog-ng options {create_dirs(yes); use_fqdn(yes); dir_owner(syslog-ng); dir_perm(0750); owner(syslog-ng); perm(0740); sync(0);}; ... source s_net { udp(ip(2.2.2.2) port(514)); }; ... log { source(s_net); filter(f_fw_1); destination(d_fw_1); flags(final); }; ... filter f_fw_all { host("DC_"); }; filter f_fw_1 { filter(f_fw_all) and host("ifw1"); }; ... destination d_fw_1 { file("/opt/syslog/log/DC_fw/$HOST/$HOST.log.$YEAR$MONTH$DAY-$HOUR" dir_group(fw-log) group(fw-log)); }; ... ... destination d_debug_all { file("/opt/syslog/log/debug/$HOST/$HOST.log.$YEAR$MONTH$DAY-$HOUR" dir_group(all-log) group(all-log)); }; ... log { source(s_net); destination(d_debug_all); flags(final);}; # grep -v ^# syslog-ng.conf | wc -l 532 # grep DC_fw /etc/inet/hosts 1.1.1.1 DC_ifw1 [problem] A message is loged to d_fw_1 and a message is loged to d_debug_all. The filename of a message loged to d_fw_1 is DC_ifw120071127-12 and the filename of a message loged d_debug_all is 1.1.1.1. I think all messages should only be loged to d_fw_1, but doesn't. I want to know what should I do to fix to my problem. thanks. --- // mailto: le.petit.planet(a)gmail.com

1 0

November 70% OFF
by Arlene＠Viagra.com 26 Nov '07

26 Nov '07

1 0

syslog-ng bugzilla
by Balazs Scheidler 26 Nov '07

26 Nov '07

Hi, We have created a public bugzilla installation in order to make syslog-ng bugtracking easier. The address is: http://bugzilla.balabit.com/ >From now on, please file syslog-ng related problems there. I've also set up an automatic bugzilla->mailing list gateway, so any changes to the bugzilla will be posted to this mailing list. -- Bazsi

1 0

IPv6 Link local address use with syslog-ng
by Philip Bellino 22 Nov '07

22 Nov '07

Hello, Running syslog-ng-2.0.5 on a Linux host 2.6.22.9. syslog-ng.conf entry as follows: source s_all { tcp6(ip(2001:470:1f00:1288:220:abff:febe:4dac) port(1468)); }; When syslog-ng is started, the Global address (2001:470:1f00:1288:220:abff:febe:4dac) binds and connects fine. If I have the Link Local Address configured below: source s_all { tcp6(ip(fe80::220:abff:febe:4dac) port(1468)); }; And start syslog-ng, it either errors on the bind or the connect(g_connect in gsockaddr.c) with an errno of 22 (Invalid Argument). Looking at the code shows that there is no use of the sockaddr_in6 "sin6_scope_id", which is required to be set when using Link Local addresses since they need to use the interface number (sin6_scope_id). Has anyone run into this issue? If so, is there a workaround or a code patch for this? Thanks, Phil Bellino Phil Bellino Software Engineer MRV Communications, Inc. 295 Foster Street Littleton, MA. 01460 Phone: 978-952-4807 Fax: 978-952-5444 Email: pbellino(a)mrv.com <http://www.mrv.com/>

4 12

TMI: spam-like messages every 30 sec?
by Kim Cary 22 Nov '07

22 Nov '07

Hi folks, Every 30 seconds I get one of these messages in my syslog file, on behalf of syslog-ng, for each and every file destination (I have about 50): Reaping unused destination files; template='/var/log/blah/$YEAR/ $MONTH/$HOST/maillog' Now this happens even for very heavily used log destinations, including the firewall, which is getting a few hundred hits a minute. Basically, this is filling up my /var partition every couple days and I'd like to stop it. I haven't found the config to use to turn this log message OFF, and I would like to know why even the busiest logs are getting tagged as 'unused'. Can someone give me some clues here? Much appreciation, KC

2 1

Tuning help?
by Cole Tuininga 21 Nov '07

21 Nov '07

I have a FreeBSD 5.4 system running syslog-ng 2.0.5 - there's no load on it. If I run the following perl code: ** Begin Code ** use Sys::Syslog qw(:DEFAULT setlogsock); # start some logging setlogsock 'unix'; openlog('task', 'pid', 'daemon'); syslog 'info', 'starting'; $txt = 'blah'; for (1..8) { syslog 'debug', $_. ' len('. length($txt) . ') '. $txt; $txt = "$txt $txt"; } for (1..100) { syslog 'debug', $_. ' len('. length($txt) . ') '. $txt; $txt = "$txt bleargh"; } ** End Code ** I seem to be dropping a random message or two during the second loop. I've tried tuning the syslog-ng conf file several different ways without luck. The relevant pieces of the current iteration of the conf file are: options { long_hostnames(off); flush_lines(1); time_reopen(10); time_reap(600); log_fifo_size(4096); }; source src { unix-dgram("/var/run/log" log_msg_size(65536) log_fetch_limit(5)); unix-dgram("/var/run/logpriv" perm(0600) log_msg_size(65536) log_fetch_limit(5)); udp(log_msg_size(65536) log_fetch_limit(5)); internal(); file("/dev/klog" log_msg_size(65536) log_fetch_limit(5)); }; destination task_log { file( "/var/log/task.log" perm(0664) ); }; filter f_task{ program("task"); }; log {source(src); filter(f_task); destination(task_log); flags(flow-control);}; Anybody have any ideas why I'm dropping random lines? Thanks in advance... -- Cole Tuininga http://www.tuininga.org/

2 2

syslog-ng-2.0.5: err "Duplicate stats counter"
by Alberto Avi 21 Nov '07

21 Nov '07

Hi everyone, I'm trying to configure a few templated logs on Linux boxes to a remote syslog-ng server (available through stunnel connection). All is working fine in the remote syslog-ng server: I can see all the data I expected and I can manage them happly. There is only a small issue on the client side: the syslog-ng don't send "stats" and "mark" messages. When I start the deamon I have this error: [root@usftpl201 sbin]# ./syslog-ng -d -v -F Duplicate stats counter; counter='tcp(AF_INET(127.0.0.1:61514))' This is my syslog-ng configuration on client side: # general options options { mark_freq(1); stats_freq(2); time_reopen(5); time_reap(300); flush_lines(1); flush_timeout(5000); log_fifo_size(3); normalize_hostnames(yes); keep_hostname(yes); use_fqdn(no); owner(root); group(root); perm(0600); dir_owner(root); dir_group(root); dir_perm(0600); log_msg_size(8192); }; # define sources source s_system { file("/var/log/messages" follow_freq(1)); file("/var/log/secure" follow_freq(1)); file("/var/log/cron" follow_freq(1)); file("/var/log/up2date" follow_freq(1)); file("/var/log/osad" follow_freq(1)); }; source s_proftpd { file("/var/log/proftpd/auth.log" follow_freq(1) flags(no-parse)); file("/var/log/proftpd/access.log" follow_freq(1) flags(no-parse)); }; # define filters filter f_system { not match("logger"); }; filter f_proftpd { not match("FTP Time"); }; # define templates template t_system { template("$DATE $HOST TYPE: MSG-SYSTEM MSG: $MSG\n"); }; template t_proftpd { template("$DATE $HOST TYPE: MSG-PROFTPD MSG: $MSG\n"); }; # define destinatios destination d_system { tcp("127.0.0.1" port(61514) template(t_system)); }; destination d_proftpd { tcp("127.0.0.1" port(61514) template(t_proftpd)); }; # define logs log { source(s_system); filter(f_system); destination(d_system); }; log { source(s_proftpd); filter(f_proftpd); destination(d_proftpd); }; This is my configuration on central syslog-ng server: options { time_reopen(15); time_reap(600); flush_lines(4); flush_timeout(6000); log_fifo_size(1); chain_hostnames(yes); normalize_hostnames(on); create_dirs(yes); chain_hostnames(yes); long_hostnames(no); keep_hostname(yes); use_fqdn(no); use_dns(no); owner(root); group(root); dir_owner(root); dir_group(root); dir_perm(0600); log_msg_size(8192); }; # define sources source s_tcp { tcp(ip(127.0.0.1) port(60514) max-connections(512) tcp-keep-alive(yes)); }; # define filters filter f_system { match("MSG-SYSTEM"); }; filter f_proftpd { match("MSG-PROFTPD"); }; # define templates template t_system { template("RECDATE: $R_YEAR/$R_MONTH/$R_DAY $R_HOUR:$R_MIN:$R_SEC SYSLOG: ussysl310 RHOST: $HOST RDATE: $S_YEAR/$S_MONTH/$S_DAY $S_HOUR:$S_MIN:$S_SEC $MS G\n"); template_escape(no); }; template t_proftpd { template("RECDATE: $R_YEAR/$R_MONTH/$R_DAY $R_HOUR:$R_MIN:$R_SEC SYSLOG: ussysl310 RHOST: $HOST RDATE: $S_YEAR/$S_MONTH/$S_DAY $S_HOUR:$S_MIN:$S_SEC $MS G\n"); template_escape(no); }; # define destinations destination d_system { file("/var/data/syslog-ng/linux-hosts/$YEAR/$MONTH/$DAY/$HOST/$HOST-$DAY$MONTH$YEAR-system.log" template(t_system)); }; destination d_proftpd { file("/var/data/syslog-ng/linux-hosts/$YEAR/$MONTH/$DAY/$HOST/$HOST-$DAY$MONTH$YEAR-proftpd.log" template(t_proftpd)); }; # define logs log { source(s_tcp); filter(f_system); destination(d_system);}; log { source(s_tcp); filter(f_proftpd); destination(d_proftpd); } Any suggestions are appreciated. Alberto.

2 2

Syslog-NG 2.0.5 on OpenBSD 4.2
by Brian A. Seklecki 21 Nov '07

21 Nov '07

http://people.collaborativefusion.com/~seklecki/openbsd42_port_syslog-ng205… # pkg_info | egrep -i "syslog|event" eventlog-0.2.5 eventlog syslog-ng library syslog-ng-2.0.5 syslogd replacement # syslog-ng -V syslog-ng 2.0.5 # uname -a OpenBSD build-openbsd-i386-42 4.2 GENERIC#375 i386 Pkgsrc is next but I have to catch a bus. ~BAS # tar tzvf /usr/ports/packages/i386/all/eventlog-0.2.5.tgz -r--r--r-- 1 root wheel 698 Nov 20 13:56 +CONTENTS -r--r--r-- 1 root wheel 149 Nov 20 13:56 +DESC -rwxr-xr-x 1 root bin 56325 Nov 20 13:52 lib/libevtlog.so.0.0 -r--r--r-- 1 root bin 6602 Nov 20 13:52 include/eventlog/evtlog.h -r--r--r-- 1 root bin 2168 Nov 20 13:52 include/eventlog/evtmaps.h -rw-r--r-- 1 root bin 90848 Nov 20 13:52 lib/libevtlog.a -rwxr-xr-x 1 root bin 811 Nov 20 13:52 lib/libevtlog.la -r--r--r-- 1 root bin 237 Nov 20 13:52 lib/pkgconfig/eventlog.pc # tar tzvf /usr/ports/packages/i386/all/syslog-ng-2.0.5.tgz -r--r--r-- 1 root wheel 528 Nov 20 14:23 +CONTENTS -r--r--r-- 1 root wheel 568 Nov 20 14:23 +DESC -r--r--r-- 1 root bin 5899 Nov 20 14:23 man/man5/syslog-ng.conf.5 -r--r--r-- 1 root bin 3268 Nov 20 14:23 man/man8/syslog-ng.8 -r-xr-xr-x 1 root bin 1215516 Nov 20 14:23 sbin/syslog-ng

1 0