- syslog-ng - lists.balabit.hu

Syslog-ng central logging server
by Shamim 23 Apr '07

23 Apr '07

Server ----------------------------- [root@plggd020 etc]# more syslog-ng.conf #sample syslog-ng.conf for a central logging server options { sync (0); log_fifo_size (2048); create_dirs (yes); group (root); dir_group (root); perm (0640); dir_perm (0750); }; source s_local { internal(); unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); }; destination d_auth { file("/var/log/auth.log"); }; filter f_auth { facility(auth, authpriv); }; source s_remote { tcp(); }; destination d_clients { file("/var/log/HOSTS/$HOST"); }; log { source(s_remote); destination(d_clients); }; log { source(s_local); filter(f_auth); destination(d_auth); }; Client ----------------- -bash-3.00# more syslog-ng.conf #sample syslog-ng.conf for a remote client source s_local { internal(); unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); }; destination d_loghost {tcp("20.5.68.82" port(514));}; log { source(s_local); destination(d_loghost); }; destination messages { file("/var/log/messages-ng"); }; log { source(s_local); destination(messages); }; -bash-3.00# And there is no message going to Server However at Client side log files shows the message as below: -bash-3.00# logger "test " -bash-3.00# tail /var/log/messages-ng Apr 23 08:44:38 s_local@zlggd052 syslog-ng[9935]: syslog-ng starting up; version='2.0.2' Apr 23 08:44:38 s_local@zlggd052 syslog-ng[9935]: Connection failed; error='No route to host (113)', time_reopen='60' Apr 23 08:45:12 s_local@zlggd052 syslog-ng[9935]: SIGTERM received, terminating; Apr 23 08:45:12 s_local@zlggd052 syslog-ng[9935]: syslog-ng shutting down; version='2.0.2' Apr 23 08:45:13 s_local@zlggd052 syslog-ng[9945]: syslog-ng starting up; version='2.0.2' Apr 23 08:45:13 s_local@zlggd052 syslog-ng[9945]: Connection failed; error='No route to host (113)', time_reopen='60' Apr 23 08:45:18 s_local@zlggd052 soetest1: test Apr 23 08:46:13 s_local@zlggd052 syslog-ng[9945]: Connection failed; error='No route to host (113)', time_reopen='60' Apr 23 08:47:13 s_local@zlggd052 syslog-ng[9945]: Connection failed; error='No route to host (113)', time_reopen='60' Apr 23 08:47:46 s_local@zlggd052 soetest1: test -bash-3.00# Please suggest what will be the reason. Thanks & Regards Shamim --------------------------------- Yahoo! Answers - Got a question? Someone out there knows the answer. Tryit now.

3 3

RE: [syslog-ng] Syslog-ng central logging server
by Geller, Sandor (IT) 23 Apr '07

23 Apr '07

[ Please reply to the list so others can follow up ] > Thanks for your prompt reply, however the output for your > "netstat -r -n" > Client: > ============ > -bash-3.00# netstat -r -n > Kernel IP routing table > Destination Gateway Genmask Flags MSS > Window irtt Iface > 20.5.68.0 0.0.0.0 255.255.255.0 U 0 0 > 0 eth1 > 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 > 0 eth1 > 0.0.0.0 20.5.68.1 0.0.0.0 UG 0 0 > 0 eth1 > -bash-3.00# > > Server: > =============== > > [root@plggd020 root]# netstat -r -n > Kernel IP routing table > Destination Gateway Genmask Flags MSS > Window irtt Iface > 20.5.68.0 0.0.0.0 255.255.255.0 U 0 0 > 0 eth0 > 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 > 0 eth0 > 0.0.0.0 20.5.68.1 0.0.0.0 UG 0 0 > 0 eth0 > [root@plggd020 root]# So the routing is OK. Could you use telnet/netcat/whatever from the client to check whether the port is open on the server and use lsof that syslog-ng is actually listening on port 514? Regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.

1 0

Problems writing to a file if destination is not /var/log
by Luc Evers 23 Apr '07

23 Apr '07

Hi, Before I used Suse 10.0 ( syslog-ng-1.6.8-3.2) , the router logfiles were send to another directoy /log/syslog. Via php-syslog-ng, the messages were also send via a pipe to a MySql database. -> no problems. Now I setup a new server withe Suse 10.2 (syslog-ng-1.6.11-23) but the logfiles outsite /var/log are not working: I get a Permission denied message, also no permission to write to the /var/log/pipe connection (php-ssylog-ng). When I send the log messages to another directory/file in /var/log than it works. How can I solve the permission problem? Rem: A chmod like 777 don't help, its like the daemons checks if the directory /var/log used + pipes or links are not allowed!

2 1

syslog-ng experimental git tree
by Balazs Scheidler 21 Apr '07

21 Apr '07

Dear syslog-ng users, I have started migrating syslog-ng from an internal GNU arch repository to a new version control system, also used by the Linux kernel project called git. For more information on git, please check out the git homepage at: http://git.or.cz/ and the numerous git tutorials available on the web. I'm still getting familiar to git, so mistakes might happen. Thus contents of this git tree are considered experimental, if something goes wrong I might need to rebuild this repository. Please take that into consideration when cloning my repository. git-web and other fancies are not yet available, just a plain dummy HTTP transport, this will change in the future. The URL of my public repository is: http://people.balabit.hu/bazsi/git/syslog-ng-2.0.git/ To clone this repository to your local hard-drive, issue the following command: git clone http://people.balabit.hu/bazsi/git/syslog-ng-2.0.git syslog-ng-2.0 -- Bazsi

1 0

syslog-ng 2.0.x bug - facility(auth) fails to match any messages
by Evan Rempel 21 Apr '07

21 Apr '07

I posted the message below a couple of weeks ago and did not get a response from anyone. Can anyone else confirm that this configuration fails to match the facility(auth) fails to match messages with a facility of auth? Balazs - can you make a comment on why this happens? Evan. -------- Original Message -------- Date: Wed, 28 Mar 2007 13:19:27 -0700 From: Evan Rempel <erempel(a)uvic.ca> Subject: 2.0.x bug - filter(auth) fails to match With the following configuration source local { unix-stream("/dev/log" max-connections(200)); file("/proc/kmsg" log_prefix("kernel: ")); internal(); }; template standard_file { template("$ISODATE $FULLHOST $FACILITY.$LEVEL $PRI $MESSAGE\n"); template_escape(no); }; destination auth.log { file("/var/syslog/auth.log.$YEAR$MONTH$DAY.000000" perm(0640) template(standard_file) ); }; destination unknown.log { file("/var/syslog/unknown.log.$YEAR$MONTH$DAY.000000" perm(0640) template(standard_file) ); }; destination test.log { file("/var/syslog/test.log.$YEAR$MONTH$DAY.000000" perm(0640) template(standard_file) ); }; filter f_auth { facility(auth); }; filter f_local1 { facility(local1); }; filter f_ldap { program(^slapd); }; # ****** PROBLEM LOG LINE **** log { source(local); filter(f_local1); filter(f_ldap); destination(test.log); }; # ****** PROBLEM LOG LINE **** log { source(local); filter(f_auth); destination(auth.log); }; # safegaurd to catch anything missed by other filters log { source(local); destination(unknown.log); flags(fallback); }; all of the log messages with the facility of auth go into the unknown.log file. If I remove the problematic log line (to test.log) or change the order of its filters or change the first filter to be other than f_local1 (even changing the f_local1 filter to match a different facility) then everything works as expected. All of these work fine # ------------- use other than filter f_local1 filter f_auth { facility(auth); }; filter f_local1 { facility(local1); }; filter f_ldap { program(slapd); }; log { source(local); filter(f_auth); filter(f_ldap); destination(test.log); }; # ------------ comment out the log line filter f_auth { facility(auth); }; filter f_local1 { facility(local1); }; filter f_ldap { program(slapd); }; # log { source(local); filter(f_local1); filter(f_ldap); destination(test.log); }; # ------------------ match facility local0 in the f_local1 filter filter f_auth { facility(auth); }; filter f_local1 { facility(local0); }; filter f_ldap { program(^slapd); }; log { source(local); filter(f_local1); filter(f_ldap); destination(test.log); }; # ----------------- make a more complex single filter rather than multiple filter item in the log line filter f_auth { facility(auth); }; filter f_local1 { facility(local1); }; filter f_ldap { program(^slapd); }; filter f_test { facility(local1) and program(^sldapd); }; log { source(local); filter(f_test); destination(test.log); }; So, how is the first example going wrong? Evan.

2 4

BUG in syslog-ng-1.6.12
by S. Schulz 19 Apr '07

19 Apr '07

Hi, 1) I found a bug in syslog-ng-1.6.12. If i use the MSGONLY macro the first char of the message is missing. Here is the patch: -snip-------------------------------- 426,427c426,428 < colon++; < ofs = (colon - (char *) msg->msg->data); --- > ofs = (colon - (char *) msg->msg->data) + 2; > if (ofs > msg->msg->length) > ofs = msg->msg->length; -snap-------------------------------- 2) And I have an other problem with a regexp in a filter. I want to log all messages that contains the "[ERR]" string to a separate err log. My filter, destination and log looks like this: filter f_usererr { facility(user) and match('\[ERR\]'); }; destination d_usererr {file("/var/log/$SOURCEIP_$PROGRAM.err"); }; log { source(s_net); filter(f_usererr); destination(d_usererr); }; What I get is a line like test[1234]:[ERR] fopen failed but also test[1234]:Event 1 or test[1234]:Released So it seems to be that the backslash before the [ is ignored. If I change the filter to filter f_usererr { facility(user) and match('ERR\]'); }; I get only the line test[1234]:[ERR] fopen failed as expected 3) And I have a third problem with creation of a filename based on the IP destination d_usererr {file("/var/log/$SOURCEIP_$PROGRAM.err"); }; The created filename is "/var/log/bla.err" and the $SOURCEIP is missing If I change the destination to destination d_usererr {file("/var/log/$SOURCEIP-$PROGRAM.err"); }; the created filename is "/var/log/192.168.1.1-bla.err" as expected Best regards Stefan Schulz -- "Feel free" - 10 GB Mailbox, 100 FreeSMS/Monat ... Jetzt GMX TopMail testen: http://www.gmx.net/de/go/topmail

3 2

Syslog-ng RPM
by steven colaco 19 Apr '07

19 Apr '07

Hello All, I'm a newbie to Syslog-ng. I want to test syslog-ng on RHEL5. Can anyone provide me the RPM format of Syslog-ng. Is eventlog also required to be installed saperately of its included within Syslog-ng. Please provide some Docs links too. Thanks in Adcance, Stevan Colaco __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 3

syslog-ng dumps core on SLES i586
by Matthur, Ananda (STSD) 19 Apr '07

19 Apr '07

Hi All, I am trying to use syslog-ng (default on SLES) on a SLES 10 i586 machine. When I try to execute a kill -s HUP 'pid-of-syslog-ng', it is crashing, dumping core. Gdb shows the following info: sgmlx1:/ # ls 1 boot core etc lib mnt proc sbin subdomain test usr bin clog dev home media opt root srv sys tmp var sgmlx1:/ # gdb /sbin/syslog-ng core GNU gdb 6.4 Copyright 2005 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i586-suse-linux"...(no debugging symbols found) Using host libthread_db library "/lib/libthread_db.so.1". (no debugging symbols found) Core was generated by `/sbin/syslog-ng'. Program terminated with signal 11, Segmentation fault. warning: Can't read pathname for load map: Input/output error. (no debugging symbols found) Loaded symbols for /sbin/syslog-ng Reading symbols from /lib/libnsl.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libresolv.so.2 Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2... (no debugging symbols found)...done. Loaded symbols for /lib/ld-linux.so.2 #0 0x8000f9a6 in do_handle_afinet_dest () from /sbin/syslog-ng (gdb) Looks like it is doing some invalid operation to cause segmentation fault. I tested the same scenario on both ia64 and x86_64 architectures. Segmentation fault occurs only on i586. Is this a known bug in syslog-ng? Is a patch available for this? Thanks and regards, ++++++++++++++++++++++++++++++++++++++ Ananda Matthur MSL Bangalore - 91 80 2205 3202 ++++++++++++++++++++++++++++++++++++++

2 1

klogd back for syslog-ng-2.x ?
by stucky 19 Apr '07

19 Apr '07

Guys I haven't touched syslog-ng since I last installed 1.6 2 years ago on RHEL4. I'm trying to upgrade to 2.x and I noticed that the init script for RH you provided in the contrib dir actually starts up syslon-ng and klogd. I thought syslog-ng was a total replacement for syslog including klodg ? I checked the older script I have for version 1.6 and sure enough it doesn't start klogd. I'm confused now as to whether I've been running this the wrong way or if you simply rewrote syslog-ng to rely on klogd again. Can anyone elaborate ? thx -- stucky

2 1

Configure error on AIX
by James B Horwath 17 Apr '07

17 Apr '07

I am trying to get syslog-ng-2.0rc4 running on AIX 5.3 I was able to compile eventlog and libol without any problems. When I configure syslog-ng I am receiving errors I need help with. I get this configuration error: ============================================================================= checking for GLIB... Package glib-2.2 was not found in the pkg-config search path. Perhaps you should add the directory containing `glib-2.2.pc' to the PKG_CONFIG_PATH environment variable No package 'glib-2.2' found configure: error: Package requirements (glib-2.2) were not met: Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. Alternatively, you may set the environment variables GLIB_CFLAGS and GLIB_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details. ================================================================== Checking for glib ============================================= rpm -qa | grep glib glib2-2.2.3-3 rpm -ql glib2-2.2.3-3 | grep -v local /opt/freeware/doc/glib2-2.2.3 /opt/freeware/doc/glib2-2.2.3/AUTHORS /opt/freeware/doc/glib2-2.2.3/COPYING /opt/freeware/doc/glib2-2.2.3/ChangeLog /opt/freeware/doc/glib2-2.2.3/NEWS /opt/freeware/doc/glib2-2.2.3/README /opt/freeware/lib/charset.alias /opt/freeware/lib/libglib-2.0.a /opt/freeware/lib/libgmodule-2.0.a /opt/freeware/lib/libgobject-2.0.a /opt/freeware/lib/libgthread-2.0.a /usr/lib/libglib-2.0.a /usr/lib/libgmodule-2.0.a /usr/lib/libgobject-2.0.a /usr/lib/libgthread-2.0.a =========================================== The code appears to be resident. How do I get around this configuration error? Regards, Jim ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

2 1