- syslog-ng - lists.balabit.hu

can't make syslog 2.0.3 on rhel 4 x64_86
by Tom H 12 Apr '07

12 Apr '07

Hi, I get the following error when making syslog 2.0.3 on rhel 4 es x64_86; else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:30:20: libnet.h: No such file or directory In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:592: error: syntax error before ')' token /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:626: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/root/syslog-ng-2.0.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/syslog-ng-2.0.3' make: *** [all] Error 2

2 1

More then one application running on syslog server
by ashish talati 11 Apr '07

11 Apr '07

Hi, I have more then one applications which generate the logs in the host and all these logs are sent to central server through syslog. I dont know how I can differentiate these logs based on individual application? below are the few logs generated in my local machine for your reference. In that first 2 logs are generated through one application and last log generated through second application. But as you can see all logs have the originating source as the pc196070/pc196070 which is the last 5 digits of my machine's ip address. I want to differentiate the logs coming from different application!! How can it possible?? ...I am blank now what to do? 05/Apr/2007 11:18:36 pc196070/pc196070 DEBUG: - [Thread- 62/Client-0] Response: RESP:0; 05/Apr/2007 11:18:36 pc196070/pc196070 Thread-62/Client-0] received: Enter command 05/Apr/2007 11:18:36 pc196070/pc196070 INFO: -N piListener.Listener - Port 12346 successfully opened. Waiting for connecti... I will appreciate your help. Thank you. B.R. Ash. --------------------------------- Check out what you're missing if you're not on Yahoo! Messenger

1 0

Trouble with switches and syslog-ng
by Jean-Michel Philippon-Nadeau 11 Apr '07

11 Apr '07

Good day everyone, We use syslog-ng to store and organize the logs of our machines (~3900). For every host we have, syslog-ng creates a folder with the hostname or the ip address (if it couldn't determine the hostname) of the machine and then stores the logs. We also have 5 switches that can report logs with standard syslog capabilities (udp on port 514). The problem is that syslog-ng doesn't create the folder for these switches and doesn't store their logs. I made sure there was no network problems by using tcpdump - the packets correctly made it to the central syslog-ng host. Yes, of course, I made sure udp(); was in my source declaration. Does anyone know how I can make sure syslog-ng receives the logs? Thanks for your help. -- Jean-Michel Philippon-Nadeau Centre de Calcul Scientifique

2 5

syslog-ng2 conf path default changed; pkg-plist out of date
by Brian A. Seklecki 10 Apr '07

10 Apr '07

Okay...who broke this: The path in the binary to the default config file has changed but the pkg-list hasn't and aside from the 2.0.2 patch level bump I dont see where else it came from: [seklecki@web05 ~]$ strings /usr/local/sbin/syslog-ng |egrep "\.conf" -f <fname>, --cfgfile=<fname> Set config file name, default=/usr/local/etc/syslog-ng.conf /usr/local/etc/syslog-ng.conf [seklecki@web05 /usr/local/cf]$ sudo bash -x /usr/local/etc/rc.d/syslog-ng restart [...snip...] ++ /usr/local/sbin/syslog-ng -p /var/run/syslog.pid Error opening configuration file; filename='/usr/local/etc/syslog-ng.conf', error='No such file or directory (2)' The work-around for the mean time is: syslog_ng_flags="-f /usr/local/etc/syslog-ng/syslog-ng.conf" I need to see a CVS changelog of certain files, but Balavid doesn't have a cvsweb, viewvc, etc. or public CVS archive? l8* -lava (Brian A. Seklecki - Pittsburgh, PA, USA) http://www.spiritual-machines.org/ "...from back in the heady days when "helpdesk" meant nothing, "diskquota" meant everything, and lives could be bought and sold for a couple of pages of laser printout - and frequently were."

2 1

test
by Chris Nelson 10 Apr '07

10 Apr '07

Initial email

1 0

syslog-ng + rhel5 + selinux
by Jan-Frode Myklebust 10 Apr '07

10 Apr '07

(Reposting now that I'm subscribed) I've created an RPM package of syslog-ng that installs the necessary selinux module to work on RHEL5. This is not creating a whole new selinux domain for syslog-ng (like I expect the reference policy to do), but rather a small extention of the RHEL5 provided syslogd domain to allow syslogd_t opening /dev/kmsg, 514/tcp and creating some files under /var. http://tanso.net/yum/repodata/repoview/syslog-ng-0-2.0.3-1.el5.html http://tanso.net/selinux/ The selinux rules installed by this RPM is http://tanso.net/selinux/syslog_ng.te and can be installed separately by saving that file to /root/syslog_ng.te and running: checkmodule -M -m -o syslog_ng.mod syslog_ng.te semodule_package -o syslog_ng.pp -m syslog_ng.mod restorecon ./syslog_ng.pp semodule -i ./syslog_ng.pp It can later be removed by "semodule --remove=syslog_ng". -jf

1 0

Compressing syslog traffic across a WAN?
by K K 10 Apr '07

10 Apr '07

Has anybody found a good way to take a high-volume stream of UDP syslog packets, aggregate and compress the packets, and then recreate them, with the original source IPs, at the other end of a WAN circuit? Looks like Riverbed cannot optimize UDP syslog?. Encapsulating the packets in an IPSEC tunnel with compression would make the packets smaller, but not reduce the packets-per-second. Tolstoy Version: I have a number of 'appliance' hosts on the west coast which generate high volumes of syslog events, which I need to forward to an 'appliance' log analysis server (EIQ) in the midwest. The version of EIQ we're stuck with only supports UDP, and uses the source IP of the packet to decide which host the event occurred on -- it cannot take the embedded hostname in the packet and use that. What we're doing right now is configuring all the west coast appliances send their syslog events to a syslog-ng server locally on the same network, which then filters out the junk events and uses spoof-source to forward these UDP packets across the slow WAN circuit to the EIQ appliances in the Midwest: Source \ Source --UDP-- syslog-ng --UDP-over-WAN-- EIQ Source / I could consider sending these events via TCP syslog to a syslog-ng server in the Midwest, and that would then send a copy of the packets via UDP to EIQ, but in this approach, I gather that we wouldn't be able to use spoof-source to regenerate the UDP packet with the original source IP? Thanks, Kevin

3 3

RE: [syslog-ng] More then one application on same server
by ashish talati 09 Apr '07

09 Apr '07

Hi, below are the few logs generated in my local machine. In that first 2 logs are generated through one application and last log generated through second application. But as you can see all logs have the originating source as the pc196070/pc196070 which is the last 5 digits of my machine's ip address. I want to differentiate the logs coming from different application!! How can it possible?? ..You suggest me program filter...So is that a solution??...if yes then please let me know how to use it exactly...I am blank in how to use it.. 05/Apr/2007 11:18:36 pc196070/pc196070 DEBUG: - [Thread- 62/Client-0] Response: RESP:0; 05/Apr/2007 11:18:36 pc196070/pc196070 Thread-62/Client-0] received: Enter command 05/Apr/2007 11:18:36 pc196070/pc196070 INFO: -NpiListener.Listener - Port 12346 successfully opened. Waiting for connecti... Thank you. B.R. Ash. --------------------------------- From: syslog-ng-bounces(a)lists.balabit.hu on behalf of Geller, Sandor (IT) Sent: Wed 4/4/2007 11:37 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] More then one application on same server > Hi, > Thank you very much for your reply. > But as I am new in this so can you please be more specific > that how can I use the Program() filter?? > Let me again tell you my specific issue- I have a Tomcat > server running and in that server I have 3 application or > nodes that generates the logs and dump into tomcat > server....Now when I use the syslog it gives me all the logs > mix with the generating source name as the hostname (tomcat > server)....but I want that syslog should give me the logs > which has the field in it from which I can identify that this > log is generated in this application and this is in other... > So I hope I describe the problem to give you exact idea!! > I will be thankful to you if you help me in this. Could you show some lines from your log originating from different programs? I'm not familiar with tomcat, so I don't understand your issue exactly... Maybe the logs have a field which could be used to differentiate between your tomcat apps. Regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

Re: tailing real files
by G.W. Haywood 08 Apr '07

08 Apr '07

Hi there, On Sat, 7 Apr 2007 Balazs Scheidler wrote: > source s_tail { file("/var/log/apache/access.log" follow_freq(1) flags(no-parse)); }; > ... > * reads the access.log file (starting with the first line), > * checks every 1 second to see if there are new records > * notices when access.log gets renamed ... > * remembers the last file position across restarts Oh, cool! Thanks!! -- 73, Ged.

1 0

capture messages from linksys router
by Robert Buecheler 08 Apr '07

08 Apr '07

please forgive me, I'm fairly new in this and don't understand much of syslog-ng. I am trying to log messages from my linksys router (192.168.1.1) The port that linksys mentions is (514), but when I run ethereal, the destination port seems to be [snmptrap (162)] (the origin port on the router varies) this is the ethereal output of 3 messages (each "line" with its IP# and UDP ports including the "packet size" of the message): --------------------------- No. Time Source Destination Protocol Info 1 0.000000 192.168.1.1 192.168.1.150 SNMP TRAP-V1 1.3.6.1.4.1.3955.1.1.0 Frame 1 (179 bytes on wire, 179 bytes captured) Internet Protocol, Src: 192.168.1.1 (192.168.1.1), Dst: 192.168.1.150 (192.168.1.150) User Datagram Protocol, Src Port: adobeserver-1 (1102), Dst Port: snmptrap (162) No. Time Source Destination Protocol Info 2 4.000204 192.168.1.1 192.168.1.150 SNMP TRAP-V1 1.3.6.1.4.1.3955.1.1.0 Frame 2 (187 bytes on wire, 187 bytes captured) Internet Protocol, Src: 192.168.1.1 (192.168.1.1), Dst: 192.168.1.150 (192.168.1.150) User Datagram Protocol, Src Port: adobeserver-2 (1103), Dst Port: snmptrap (162) No. Time Source Destination Protocol Info 3 8.000308 192.168.1.1 192.168.1.150 SNMP TRAP-V1 1.3.6.1.4.1.3955.1.1.0 Frame 3 (181 bytes on wire, 181 bytes captured) Internet Protocol, Src: 192.168.1.1 (192.168.1.1), Dst: 192.168.1.150 (192.168.1.150) User Datagram Protocol, Src Port: xrl (1104), Dst Port: snmptrap (162) --------------------------- syslog-ng (1.6.8) is running on IP 192.168.1.150 (SUSE 10.0 linux, 2.6.13-15.15-smp kernel). from different sources, I got the following lines in the syslog-ng.conf file: ####################################### source src-linksys { internal(); unix-dgram("/dev/log"); unix-dgram("/var/lib/named/dev/log"); udp(ip("192.168.1.150") port(162)); udp(ip("192.168.1.150") port(514)); }; filter f_user { facility(user); }; destination linksys { file("/var/log/linksys.log"); }; log { source(src-linksys); filter(f_user); destination(linksys); }; ####################################### unfortunately /var/log/linksys.log doesn't exist and/or is never written can somebody help? thx, Robi

2 1