- syslog-ng - lists.balabit.hu

misspell in the v2.0 reference
by Πιστιόλης Κωνσταντίνος 21 Mar '07

21 Mar '07

Hi all, I've set up syslog-ng on my debian etch, to accept logs my remote hosts. I have noticed that the dns_cache_host() directive which is mentioned in http://www.balabit.com/products/syslog_ng/reference-2.0/syslog-ng.txt is not working. Instead, it works with dns_cache_hosts() It propably is a misspell error, but it took me 2 hours to figure out... Is this the right place to mention this? If not, where should I? Pistiolis Konstantinos

2 1

map "mark.info" in syslog.conf to syslog-ng.conf
by Lily Feng 20 Mar '07

20 Mar '07

Hi , I tried to map the syslog.conf to syslog-ng.conf via syslog2ng: mark.info It is mapped to filter f_1 { facility(mark) and level(info..emerg);} It could not pass the verification because facility(mark)is not correct. How to fix it? Thanks, Lily

3 6

RE: [syslog-ng] Syslog-ng log file overwrite
by Padmanabhan, Rajeesh (GE Healthcare) 19 Mar '07

19 Mar '07

Hi Kevin, Thanks a lot for the information & help. Is there a way to include 'user name' or userid from which the log generated to each log? I coudnt find the macro (eg: $HOST) for user name/uid. Thanks, Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of K K Sent: Saturday, March 10, 2007 1:18 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng log file overwrite On 3/9/07, Padmanabhan, Rajeesh (GE Healthcare) <Rajeesh.Padmanabhan(a)ge.com> wrote: > Hi Valdis, > > Thanks for the help. Could you please explain below questons? > > 1. Will the below format overwrites existing log file? Unless you specify otherwise (using remove_if_older), if a file exists, it is opened for appending instead of being overwritten. > file("/logs/$HOST/$YEAR/$MONTH/messages-$YEAR-$MONTH$DAY"); In the above case, $YEAR is always unique, the directory and files will always have a unique name. > 2. Is there a way to roate log file based on the size? No size-based rotation is built into syslog-ng. You could write a script, but I find it easier to just have syslog-ng create many smaller files, and then either compress or purge these files using a cron job. > Idea is I don't want my log partition gets filled & alerts due to > lacks of space :) Running out of disk space is a risk. What I do is specify the destination like this: file("/var/log/remote/$HOST/$WEEKDAY/$HOUR" remove_if_older(259200) sync(60) ); Additionally, I have a cron job to compress older logs by as much as 98%: @midnight find /var/log/remote -type f -name '[0-2][0-9]' -ctime +3 -print0 |xargs -r -0 bzip2 -f Kevin _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

log statistics level
by bryanh＠giraffe-data.com 19 Mar '07

19 Mar '07

When Syslog-ng logs its hourly statistics, it uses level NOTICE. This seems like a classic case for INFO instead. NOTICE is an event of which someone might want to take notice, e.g. "nightly backup has started" or "RAID rebuild is complete." INFO is just information someone might want to refer to later. -- Bryan Henderson San Jose, California

4 7

Syslog-ng fails to listen at port 514
by Vivek Raju 19 Mar '07

19 Mar '07

Hi, I am trying to implement a centralized syslog-ng solution for testing purpose. My configuration is SLES10 on mainframe guest. I had followed the steps given in the article below. http://www.novell.com/coolsolutions/feature/18044.html I have created the configuration on server # # uncomment to process log messages from network: udp(port(514)); tcp(ip("192.168.1.42") port(5140) keep-alive(yes)); # this is for separating out network hosts into individual log files. destination std { file ("/var/log/HOSTS/$YEAR-$MONTH/$HOST/$FACILITY-$YEAR-$MONTH-$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(y\es) ); }; log { source(src); destination(std); }; I then ran SuSEconfig --module syslog-ng. After that i started the syslog service thru /etc/init.d On the client i have added these lines to /etc/syslog-ng/syslog-ng.conf.in # send everything to log host destination loghost { tcp("192.168.1.42" port(5140)); }; log { source(src); destination(loghost); My Problem is when i do netstat -an|grep 514 or netstat -an|grep 5140 nothing comes up. on the client side i see errors in the /var/log/messages stating "error connecting to remote system" I am not sure but i think the problem is because of UDP 514 or TCP 5140 not being working. I checked the /etc/services and looks fine. has anyone had same kind of problem. Would be glad if someone could help in determining the cause. Vick };

2 1

Where is the download link for 2.0 ?
by Dave Augustus 19 Mar '07

19 Mar '07

Everyplace on http://www.balabit.com I try just leads me to http://www.balabit.com/downloads/syslog-ng/2.0/ Thanks, Dave

3 2

Log rotate without log rotate.
by Bruno Vieira 17 Mar '07

17 Mar '07

Hi there. I have a question and at the same time i almost know that it must exist a way of doing this. The situation is: I want that my logs act as FIFOs. I mean.. I want my log files to have a max of 100 KB or 100 lines (the one that is most convenient to find a solution). If I use a pipe, I have the problem that if I read on one side of the pipe, it continues dumping it's content until getting empty regardless of having more messages coming in through the other end. But what I want is a pipe that that keeps it's content and only flushes a message out every time it receives a message in. Just like a FIFO.. I want this behaviour in a file... named pipe? I don't know the solution for this but I can feel that it is out there :) This way I would have a log rotation without using log rotate that normally it copies the file content to a new one and than syslog-ng starts writing on an empty one. Tell me what you think about this. Best regards, Bruno.

4 5

Re: Log rotate without log rotate.
by G.W. Haywood 16 Mar '07

16 Mar '07

Hi there, On Fri, 16 Mar 2007 Bruno Vieira wrote: > ... the problem here is that the device that will be logging have memory > restrictions. > So, I want a log that acts as a fifo. And every time a new message comes, > the oldest one gets out. > ... > I would like to have only one file per destination (ex: auth.log) and keep > that file within 100 - 120 KB or 100 lines, per example. I want it to be > circular... to be like a FIFO. Why don't you just log to a remote host? > I have a solution.. but I think there can be a better one. My solution is: > having a midlle program between syslog-ng and the destination file. And for > every message received, the program would verify if the destination file ( > p.e. auth.log) already has 100 lines. If so, deleted the last line, make all > others one ENTER down and that append the new line to the beginning of the > file. Don't do it like that. Your 'middle program' might bring the machine to its knees if syslog gets a lot of messages. You could write a script which stores 100 lines in a buffer and deletes the oldest line every time a new line comes in, and make it respond to a signal (for example SIGHUP) by writing its entire buffer to a screen or to a file. > But this seems to be a very "manual" solution... It is. -- 73, Ged.

1 0

Syslog-ng and network failover
by Jonathon Blumenthal 16 Mar '07

16 Mar '07

I need to have a highly available centralized log server (all Linux). Is there a way to configure syslog-ng to automatically detect when the remote syslog server has gone down so that it can redirect messages elsewhere? Something like this: destination d_tcp1 { tcp("192.168.1.1"); failover(d_tcp2); }; destination d_tcp2 { tcp("192.168.1.2"); }; If not, anyone know of any Linux loggers that will do this? -Jon ----------------------------------------- The information contained in this email message and its attachments is intended only for the private and confidential use of the recipient(s) named above, unless the sender expressly agrees otherwise. Transmission of email over the Internet is not a secure communications medium. If you are requesting or have requested the transmittal of personal data, as defined in applicable privacy laws by means of email or in an attachment to email, you must select a more secure alternate means of transmittal that supports your obligations to protect such personal data. If the reader of this message is not the intended recipient and/or you have received this email in error, you must take no action based on the information in this email and you are hereby notified that any dissemination, misuse or copying or disclosure of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by email and delete the original message.

6 5

Re: log statistics level
by G.W. Haywood 11 Mar '07

11 Mar '07

Hi there, FWIW I'd be happy if nothing changed. I use syslog-ng to pipe messages to scripts and I'd hate for things to break because of some log message getting into the wrong file. Besides, I'm used to looking at things the way they are. Just my 0.02p -- 73, Ged.

1 0