- syslog-ng - lists.balabit.hu

ArcSight Server As Destination?
by Ivey, Chris 17 May '07

17 May '07

Folks, Does anyone have any experience with using syslog-ng to forward messages along to an ArcSight server? I set it up for a support group here, but apparently they are having issues. Per ArcSight support: <quote> "I looked over the information you had uploaded already, and is actually a common issue. When syslog events are forwarded from one syslog server to another syslog server, or pipe, or file, the forwarding syslog server prepends timestamp and other information, which makes the message unusable. We require syslog message to adhere to the standard RFC syslog format for the connector to read them, and when forwarding syslog messages that is not the case and we are unable to support that configuration." </quote> Does anyone have any insight they can share with me for this issue? The group is now asking that I install their agent on my server, which I am VERY loath to do since the box is about at it's limit as it is. Thanks all! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

4 4

Re: syslog server and windows
by Alejandro Sierra 15 May '07

15 May '07

Hi, 2 Options for sending eventviewer events to a syslog-ng server Lasso (http://www.loglogic.com/logforge/) supports TCP and I have proved it with syslog-ng with good results. You can choose the log (Application, System, Security), the polling interval, .. NTSyslog( http://ntsyslog.sourceforge.net/) another option that uses UDP, that makes better use of the syslog protocol(facility, severity). PD: Sorry for my english. > Hello list, > > I have mounted a syslog-ng server and I need to also send data to it > from Windows servers. Said log's of Windows they would have to be of > eventlog, ISS, exchange, etc. Some program that do it? I proved epiloj > (snare) but it does not serve to me. > > Thanks for all. > > -- > Power by Debian. > > A greeting, > > Javier. >

1 0

syslog-ng 2.0.0 and "-- MARK --" messages
by Mick Ohrberg 15 May '07

15 May '07

Hello! I'm wondering about the MARK messages that show up in my logs. While I have deduced that the default value is 1200 seconds, I can't seem to turn it off. Adding a "mark(86400);" stanza gets me a syntax error that the mark() keyword isn't valid. Am I missing something very basic here, or is there more to this? Thank you in advance. -- A: Because it's counterintuitive to the way we read. Q: Why is top-posting bad?

2 2

syslog server and windows
by Javier Terceiro 15 May '07

15 May '07

Hello list, I have mounted a syslog-ng server and I need to also send data to it from Windows servers. Said log's of Windows they would have to be of eventlog, ISS, exchange, etc. Some program that do it? I proved epiloj (snare) but it does not serve to me. Thanks for all. -- Power by Debian. A greeting, Javier.

1 0

Logging a file to another syslog-ng server for indexing
by Corey Bobb 14 May '07

14 May '07

Sorry about the reply when I should have created a new msg. Hello all, I am trying to add a specific file for syslog to pickup and log remotely but have been unable to make it work. The file I am trying to get over to another syslog-ng server is an audit log. What has to happen is from 1 server the log file gets read/moved over to the other Log server . . .which will then be indexed by splunk. I am learning syslog-ng and am not sure exactly how to make what I am trying to do work. If anyone has any ideas or suggestions please drop me a note! Thanks cygnus_logo Corey M. Bobb System Administrator 850 South Concourse Parkway Maitland, FL 32851 Office - 321-455-2150 Cell - 407-947-7832

2 1

Syslog-ng 2.0.3 make error
by Diana Orrick 14 May '07

14 May '07

Would really like to be able to use this tool... Red Hat 2.6.9-55.ELsmp i686 i386 GNU/Linux On Mon, 2007-04-30 at 10:02 -0400, Justin Randall wrote: > Hello, > > I am also experiencing this compile error when building Syslog-NG-2.0.3 > on a CentOS (Linux) 4.4 host. Install libnet or disable spoof-source support. -- Bazsi I installed libnet, both an older version (to get libnet-config) and the CPAN perl module... Have updated and hand-installed glib (and all its flavors...) have tried with/without " --with-dynamic-linking " with libnet I get the odd syntax errors (would prefer to be able to use this version, and enable spoof sourcing, code update coming?) In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:592: error: syntax error before ')' token /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:626: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/tmp/syslog-ng-2.0.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/tmp/syslog-ng-2.0.3' make: *** [all] Error 2 after disabling enable-spoof_source, I get different errors (these seem to relate to glib issues noted earlier): gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -lwrap -Wl,-Bdynamic libsyslog-ng.a(misc.o)(.text+0x3a9): In function `resolve_hostname': /tmp/syslog-ng-2.0.3/src/misc.c:191: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x6a): In function `log_stamp_format': /tmp/syslog-ng-2.0.3/src/logmsg.c:110: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x2b6): In function `log_msg_ref': /tmp/syslog-ng-2.0.3/src/logmsg.c:498: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x342): In function `log_msg_unref': /tmp/syslog-ng-2.0.3/src/logmsg.c:512: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0xe2a): In function `log_msg_ack_block_end': /tmp/syslog-ng-2.0.3/src/logmsg.c:648: undefined reference to `g_return_if_fail_warning' libsyslog-ng.a(logpipe.o)(.text+0x4f): In function `log_pipe_ref': /tmp/syslog-ng-2.0.3/src/logpipe.c:38: undefined reference to `g_assert_warning' libsyslog-ng.a(logpipe.o)(.text+0x9b): In function `log_pipe_unref': /tmp/syslog-ng-2.0.3/src/logpipe.c:47: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x7d): In function `log_endpoint_free': /tmp/syslog-ng-2.0.3/src/center.c:90: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x175): In function `log_connection_new': /tmp/syslog-ng-2.0.3/src/center.c:132: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x2de): In function `log_template_ref': /tmp/syslog-ng-2.0.3/src/templates.c:180: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x346):/tmp/syslog-ng-2.0.3/src/templates.c:191: more undefined references to `g_assert_warning' follow collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/tmp/syslog-ng-2.0.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/tmp/syslog-ng-2.0.3' make: *** [all] Error 2 even tried installing syslog-ng-2.0.2, thinking it more 'stable' suggestions welcome, I'd like to get this working... ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Diana Mayer Orrick email: orrick(a)fsu.edu University Computing Services ph: (850) 645-8009 Florida State University fax: (850) 644-8722 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

5 7

Starting syslog_ng daemon with chkconfig on Linux
by Shamim 14 May '07

14 May '07

Hi, When I try to start syslog_ng daemon with chkconfig it says. Syslog_ng-2.0.2 service syslog_ng does not support chkconfig Am I missing something ? or how to start syslog_ng daemon with chkconfig on Linux. Please advise. Thanks --------------------------------- Yahoo! Answers - Got a question? Someone out there knows the answer. Tryit now.

3 2

syslog-ng stats
by Jason Qualkenbush 11 May '07

11 May '07

Can someone explain what the difference is between "queued" and "received"? I'm looking at the difference between two different syslog-ng servers. On the light server, the queued and received counter always match. On the heavily loaded server the queued and received differ quite a bit: processed='center(queued)=4988110' processed='center(received)=1103080' Am I losing messages? -Jason

2 1

RE: [syslog-ng] mount syslog server
by Alejandro Sierra 10 May '07

10 May '07

Hi, Lasso (http://www.loglogic.com/logforge/) is a good option for sending eventlog messages to syslog-ng. It supports TCP, u can choose the logs to be forwarded, the polling interval and it behaves as a service. One thing i didn`t like is that it doesn't use the facility and severity, like NTSyslog( http://ntsyslog.sourceforge.net/) another option that uses UDP, that makes better use of the syslog protocol. So it depends on ur needs. If u want to use TCP Lasso, otherwise NTSyslog. PD: Sorry for my english.

1 0

RE: mount syslog server (Javier Terceiro)
by Gregory Zill 10 May '07

10 May '07

Snare for windows Sourceforge.net/projects/snare gregory w zill systems engineer II -----Original Message----- Date: Thu, 10 May 2007 11:47:57 +0200 From: "Javier Terceiro" <correolista(a)gmail.com> Subject: [syslog-ng] mount syslog server To: syslog-ng(a)lists.balabit.hu Message-ID: <602eb19e0705100247v4be883cfo96ebf4b08aeddb21(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hello list, I'm mounting a syslog-ng server for centralize the log's of my net. The servers with linux is ok, but for windows server's, I need a tool for send the messages. What can I use? Some idea? Thanks. -- Power by Debian. A greeting, Javier. ------------------------------

1 0