- syslog-ng - lists.balabit.hu

Disconnected access/tailing real files/web interface
by J Bridge 06 Apr '07

06 Apr '07

Hello. I would like to centralise logs from many different hosts into one place. It's possible that the network connectivity between the log server and the hosts is not reliable. Therefore: 1. Can I get syslog-ng to send new log entries once it can see the central log server again? I would also like to centralise logs from non-syslog programs such as some big database apps. 2. Can syslog-ng work similarly to tail -f logging to the central server? And finally (but least importantly).. 3. Does anyone know a good web interface for viewing or searching the files from a web interface? The logs must remain as files, not be put in a mysql database. Thanks, jbj

2 2

Syslog-ng version 2.0.3 memory problems
by James Long 06 Apr '07

06 Apr '07

I've installed syslog-ng-.2.0.3 on a Red Hat Enterprise Linux 5 server. I'm using eventlog-0.2.5 and libnet 1.1.2.1. I compiled syslog-ng without any problems. I've got a fairly generic config file. Whenever I start the service; the process will chew through all of the available ram on the server (2 gb) then terminate with the following error Glib-ERROR gmem.c:514: failed to allocated ### bytes. This usually takes about 15 minutes to happen. Any thoughts? Thanks Jim

2 6

problem with accents in log messages
by Nagy Daniel 05 Apr '07

05 Apr '07

Hello, syslog-ng version: 2.0.2 System: RHEL4, locale: en_US.UTF-8 Without a template in the destionation, the accented characters appear well: Using this config: source s_net { tcp(); udp(); }; destination d_nettest { file("/var/log/nettest.log"); }; filter f_nettest { host(localhost); }; log {source(s_net); filter(f_nettest); destination(d_nettest); }; Then I do a 'nc localhost 514' and type 'abbé', I properly receive 'Apr 5 10:49:59 localhost/localhost abbé' in /var/log/nettest.log. However, using this config: source s_net { tcp(); udp(); }; destination d_nettest { file("/var/log/nettest.log" template ("$YEAR.$MONTH.$DAY $HOUR:$MIN:$SEC $TZOFFSET $HOST $MSG\n")); ); }; filter f_nettest { host(localhost); }; log {source(s_net); filter(f_nettest); destination(d_nettest); }; I receive this: 2007.04.05 10:48:51 +02:00 localhost abb\37777777751 Thus, 'é' is converted to '\37777777751' Is it a known bug or am I missing something? Thanks, Daniel ps: eljenek a veszpremi infosok

2 2

Localport() & localip() cause syntax error in 2.0.2
by simonst＠wellsfargo.com 05 Apr '07

05 Apr '07

Localip() and localport() parms still causing a syntax error, after straightening out semicolons (thanks to Evan Rempel). # syslog-ng -V syslog-ng 2.0.2 # cat -n syslog-ng.test #Show syslog-ng.test without localip() & localport() 1 options { long_hostnames(off); sync(0); }; 2 source src { unix-stream("/dev/log"); internal(); }; 3 source kernsrc { file("/proc/kmsg"); }; 4 destination logger { tcp("10.11.12.13" port(5678) template("$UNIXTIME $HOST $MESSAGE\n") ); }; 5 log { source(src); source(kernsrc); destination(logger); }; # syslog-ng -dFsf syslog-ng.test # No syntax error without localip() & localport() # cat -n syslog-ng.test #Add localip() & localport() to syslog-ng.test 1 options { long_hostnames(off); sync(0); }; 2 source src { unix-stream("/dev/log"); internal(); }; 3 source kernsrc { file("/proc/kmsg"); }; 4 destination logger { tcp("10.11.12.13" port(5678) localip(10.9.8.7) localport(5678) template("$UNIXTIME $HOST $MESSAGE\n") ); }; 5 log { source(src); source(kernsrc); destination(logger); }; # syslog-ng -dFsf syslog-ng.test syntax error at 4 # SYNTAX ERROR with localip() & localport()

3 6

More then one application on same server
by Talati, Ashish J 04 Apr '07

04 Apr '07

Hi, I have more then one applications running on my server which generates and sends logs to central server using syslog-ng, and I need to identify in the syslog that which log is coming from which application?? currently I can only identify the server name (as the source of orginating all logs) which mix all the logs. Can anybody please help me in solving my issue?? I am kind of stuck at this point. I will be thankful for any kind of help. B.R. Ash.

2 3

More then one application running on same server
by Talati, Ashish J 04 Apr '07

04 Apr '07

Hi, Thank you very much for your reply. But as I am new in this so can you please be more specific that how can I use the Program() filter?? Let me again tell you my specific issue- I have a Tomcat server running and in that server I have 3 application or nodes that generates the logs and dump into tomcat server....Now when I use the syslog it gives me all the logs mix with the generating source name as the hostname (tomcat server)....but I want that syslog should give me the logs which has the field in it from which I can identify that this log is generated in this application and this is in other... So I hope I describe the problem to give you exact idea!! I will be thankful to you if you help me in this. B.R. Ash

1 0

new manuals
by Balazs Scheidler 04 Apr '07

04 Apr '07

Hi, My fellow tech-writer collegue has worked on a new, updated and extended syslog-ng manual, and we are now ready to publish a non-final version, available at the following URLs: PDF: http://www.balabit.com/common-dl/syslog-ng-admin-guide_en_draft.pdf HTML: http://www.balabit.com/common-dl/syslog-ng-admin-guide_en.html/bk01-toc.html Any feedback is appreciated, please send comments to the list, or to documentation(a)balabit.com Thanks. -- Bazsi

3 3

RE: Possible bug due to unusual configuration
by Matthur, Ananda (STSD) 04 Apr '07

04 Apr '07

Hi All, I am using syslog-ng on SLES linux (shipped by default from SLES). I found out a rather unusual behaviour, which seems to be a bug in syslog-ng: Excerpt from my configuration file: I have the definition of a single source two times, in different places of my configuration file, as follows: . . source s_clog_tail { pipe("/dev/log_consolidation_fifo"); }; .. .. source s_clog_tail { pipe("/dev/log_consolidation_fifo"); }; .. .. When I try to use syslog-ng with -s option, it does not complain, but if I run syslog-ng, it does not log messages from this source. i.e., it fails to log messages from this source. Should I file this as a bug in syslog-ng? The duplicate definition is probably a msitake and definitely not needed, and after removing the duplicate definition, everything works fine. Just wondering why double definition fails, though. Thanks and regards, ++++++++++++++++++++++++++++++++++++++ Ananda Matthur MSL Bangalore - 91 80 2205 3202, 919448721794 ++++++++++++++++++++++++++++++++++++++

1 0

syslog-ng Premium Edition
by Balazs Scheidler 03 Apr '07

03 Apr '07

Dear syslog-ng users, As some of you might already know from my blog, BalaBit has started working on a commercial fork of syslog-ng, named "syslog-ng Premium Edition". While the number of differences between the current premium and open source versions is marginal, it is expected to grow over time. We are planning to use dual-licensing: * the free edition will be available under the GPL, just as it's been in the past, * the commercial edition will be covered by a conventional, commercial license The two editions will be released from the same source tree, ensuring that non-differentiating changes will become part of both the free and commercial versions. I hope the syslog-ng community finds this change acceptable in the direction of syslog-ng, as it will result in more choices and a better syslog-ng. I - as the author of syslog-ng - personally think that this change will make it possible to allocate more resources to syslog-ng itself which will also benefit the users of the free edition of syslog-ng. This change is going to trigger some changes as the current syslog-ng development infrastructure goes: * this mailing list remains The list of the open source version of syslog-ng, apart from this single time posting BalaBit does not plan to use it as a "marketing" resource. * the syslog-ng-announce mailing list will become a more "traditional" product announcement mailing list for all editions of syslog-ng, so commercial announcements will be sent there too. * the website will be restructured in the near-future to include a spot for both editions, a separate page for syslog-ng open source edition will remain active though I think those are about the things that I wanted to inform you in advance. We'll see how things work out. If you have questions, please feel free to ask, either on the mailing list, or by sending a personal email to me. -- Bazsi

2 1

./configure: line 6998: --defines: command not found
by Mr. James W. Laferriere 30 Mar '07

30 Mar '07

Hello All , THis one is kind of interesting . ./configure seems to have a variable that remains or becomes null . dug it out ... $ grep -n . ./configure | grep -C3 -n 6998 6267-6995: LIBNET_CONFIG=$with_libnet/libnet-config 6268-6996: fi 6269-6997: if test -x $LIBNET_CONFIG; then 6270:6998: LIBNET_CFLAGS="`$LIBNET_CONFIG --defines`" 6271-6999: LIBNET_LIBS="`$LIBNET_CONFIG --libs`" 6272-7000: { echo "$as_me:$LINENO: result: yes" >&5 6273-7001:echo "${ECHO_T}yes" >&6; } Commandling used for ./configure $ LDFLAGS="-static" PKG_CONFIG_PATH="${PKG_CONFIG_PATH}:../eventlog-0.2.5" ./configure --enable-static-linking --enable-tcp-wrapper --enable-spoof-source The output from the above . ...snip... checking for getaddrinfo... yes checking for getutent... yes checking for TCP wrapper library... checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... yes checking for LIBNET... which: no libnet-config in (/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin:/home/jlaferri/bin) ./configure: line 6998: --defines: command not found ./configure: line 6999: --libs: command not found yes checking for static GLib libraries... yes configure: creating ./config.status config.status: creating dist.conf config.status: creating Makefile config.status: creating syslog-ng.spec.bb config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating doc/docvars.xml config.status: creating contrib/Makefile config.status: creating tests/Makefile config.status: creating solbuild/Makefile config.status: creating tests/unit/Makefile config.status: creating tests/functional/Makefile config.status: creating config.h config.status: executing depfiles commands -- +-----------------------------------------------------------------+ | James W. Laferriere | System Techniques | Give me VMS | | Network Engineer | 663 Beaumont Blvd | Give me Linux | | babydr(a)baby-dragons.com | Pacifica, CA. 94044 | only on AXP | +-----------------------------------------------------------------+

1 0