- syslog-ng - lists.balabit.hu

$MSG value
by news gonzo news gonzo 18 Dec '06

18 Dec '06

Hello, Should it be possible to modify the value of $MSG or $MSGONLY (with a tool like sed for example) ? Thx in advance. ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com

3 2

syslog-ng 2.0.0 successful on Mac OS X Tiger
by Orth, Alan 14 Dec '06

14 Dec '06

Good morning, For some time now I've have syslog-ng 1.6 working on Mac OS X Panther servers, but I could never get 1.6 or 1.9 (and probably some early 2.0 betas) to work. I just completed an install of 2.0.0 on a clean installed Tiger server. I don't have a complicated logging setup (4 filters, 4 logging destinations), but I do like syslog-ng's ability to eliminate the need for log rotation by logging filters and directory structures... I know I had been trying every few months over the last year or so to get this installed, and a few other people posted with trouble getting it to run, so I'll post some stats about my setup: Machine is a 2 GHz G5 Xserve running Mac OS X Server 10.4.8 (8L127). $ uname -a Darwin hostname.school.edu 8.8.0 Darwin Kernel Version 8.8.0: Fri Sep 8 17:18:57 PDT 2006; root:xnu-792.12.6.obj~1/RELEASE_PPC Power Macintosh powerpc RackMac3,1 Darwin Good work, whoever fixed it! -- Alan Orth Upward Bound - Systems Administrator User Services - Field Technician California State University, Chico x6000

3 9

syslog-ng 2.0.0 successful on Mac OS X Tiger
by Usman Wahid 14 Dec '06

14 Dec '06

Listed below: struct in6_addr { union { __uint8_t __u6_addr8[16]; __uint16_t __u6_addr16[8]; __uint32_t __u6_addr32[4]; } __u6_addr; /* 128-bit IP6 address */ }; On Mon, 2006-12-04 at 14:00 +0800, Usman Wahid wrote: >Hi, > >I am getting the following error message, while compiling syslog-ng-2.0 on >Mac OS X server 10.4.6, > >dnscache.c: In function 'dns_cache_key_hash': >dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' >dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' >dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' >dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' >make[2]: *** [dnscache.o] Error 1 >make[1]: *** [all-recursive] Error 1 >make: *** [all] Error 2 > >I am using eventlog-0.2.6, glib-2.12.4 and pkg-config-0.21. Any ideas to >solve the problem? Can you show me the definition of struct in6_addr in your system header files? -- Bazsi _________________________________________________________________ Find singles online in your area with MSN Dating and Match.com! http://cp.intl.match.com/eng/msn/msnsg/wbc/wbc.html

2 1

syslog-ng overload
by Serge Torop 13 Dec '06

13 Dec '06

Hello, all. On my system Linux RedHat EL AS3 kernel: Linux 2.4.21-20.EL #1 Wed Aug 18 20:58:25 EDT 2004 i686 i686 i386 GNU/Linux I note high loading CPU 99% by syslog-ng. Syslog-ng version 1.6.11 (1.6.8 too), libol 0.3.18 (0.3.16 too). Is this possible to resolve high loading CPU problem? Thanks to advance. Top cmd output: 21:33:07 up 20 days, 10:13, 3 users, load average: 1,09, 1,71, 1,93 112 processes: 109 sleeping, 3 running, 0 zombie, 0 stopped CPU states: cpu user nice system irq softirq iowait idle total 21,6% 0,0% 78,4% 0,0% 0,0% 0,0% 0,0% Mem: 510932k av, 351192k used, 159740k free, 0k shrd, 80412k buff 201384k actv, 82448k in_d, 2608k in_c Swap: 1975912k av, 13060k used, 1962852k free 181536k cached PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND 23460 root 25 0 852 852 664 R 99,8 0,1 3:36 0 syslog-ng 23518 root 15 0 1188 1188 848 R 0,1 0,2 0:00 0 top 1 root 15 0 496 460 436 S 0,0 0,0 0:04 0 init 2 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 keventd 3 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 kapmd 4 root 34 19 0 0 0 SWN 0,0 0,0 0:00 0 ksoftirqd/0 7 root 25 0 0 0 0 SW 0,0 0,0 0:00 0 bdflush 5 root 15 0 0 0 0 SW 0,0 0,0 0:21 0 kswapd 6 root 15 0 0 0 0 SW 0,0 0,0 0:14 0 kscand 8 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 kupdated 9 root 15 0 0 0 0 SW 0,0 0,0 0:18 0 mdrecoveryd 18 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 raid1d 19 root 15 0 0 0 0 SW 0,0 0,0 0:05 0 raid1d 20 root 15 0 0 0 0 SW 0,0 0,0 0:14 0 raid1d 21 root 15 0 0 0 0 SW 0,0 0,0 0:03 0 raid1d 22 root 15 0 0 0 0 SW 0,0 0,0 0:03 0 kjournald 79 root 23 0 0 0 0 SW 0,0 0,0 0:00 0 khubd 1648 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 kjournald 1649 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 kjournald 1650 root 15 0 0 0 0 SW 0,0 0,0 20:21 0 kjournald # ldd /sbin/syslog-ng librt.so.1 => /lib/tls/librt.so.1 (0x00d02000) libnsl.so.1 => /lib/libnsl.so.1 (0x007b5000) libresolv.so.2 => /lib/libresolv.so.2 (0x00ef5000) libc.so.6 => /lib/tls/libc.so.6 (0x00111000) libpthread.so.0 => /lib/tls/libpthread.so.0 (0x00df5000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x00691000) # syslog-ng configuration file. # Main configuration # -------------------------------------------------------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); use_time_recvd(yes); stats(3600); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log" max_connections(2000)); internal(); }; # Filters section # --------------------------------------------------------------- destination d_kern { file("/var/log/kernel/kernel.$MONTH.$YEAR"); file("/dev/tty12"); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages.$FACILITY.$LEVEL"); }; destination d_auth { file("/var/log/secure/secure.$MONTH.$YEAR"); }; destination d_authinfo { file("/var/log/secure/auth-info.$MONTH.$YEAR"); }; destination d_mail { file("/var/log/mail/maillog.$DAY.$MONTH.$YEAR"); }; destination d_mailacct { file("/var/log/mail/act/mailacct.$DAY.$MONTH.$YEAR"); }; destination d_fetchm {file("/var/log/fetchmail/fetchmaillog.$DAY.$MONTH.$YEAR"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot/boot.$MONTH.$YEAR"); }; destination d_cron { file("/var/log/cron/cron.$MONTH.$YEAR"); }; destination d_mlal { usertty("*"); file("/var/log/console/console.$MONTH.$YEAR"); file("/dev/tty10"); }; destination d_named { file("/var/log/named/named.$MONTH.$YEAR"); }; destination d_iptbl { file("/var/log/iptables/iptables.$MONTH.$YEAR"); file("/dev/tty11"); }; destination d_daemons { file("/var/log/daemons/daemons-info.$MONTH.$YEAR"); }; destination d_pop { file("/var/log/pop/poplog.$DAY.$MONTH.$YEAR"); }; destination d_useradd { file("/var/log/secure/useradd.log"); }; destination d_apcupsd { file("/var/log/apc/apcupsd.log"); }; destination d_syslogngd { file("/var/log/syslog-ng/syslog-ng.$MONTH.$YEAR"); }; destination d_smartd { file("/var/log/smartd/smartd.$MONTH.$YEAR"); }; destination d_drwebp { file("/var/log/drweb/mail/drweb-postfix-$DAY.$MONTH.$YEAR"); }; # Filters sections # ----------------------------------------------------------------- filter f_filter1 { facility(kern) and not match("IPFILTER"); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron) or facility(local1) or facility(local2) or facility(local3) or facility(local4) or facility(local5) or (facility(daemon) and level(info)) or (facility(kern) and level(info)) or (facility(auth) and level(info)) ); }; filter f_filter3 { facility(authpriv) and not match("useradd"); }; filter f_filter4 { facility(mail) and not (match("mailacct") or match("fetchmail")); } ; filter f_filter5 { level(err..emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; filter f_filter9 { facility(mail) and match("mailacct"); }; filter f_filter10 { match("named"); }; filter f_filter11 { facility(kern) and match("IPFILTER"); }; filter f_filter12 { facility(daemon) and not match("dhcpd") and not match("apcupsd"); }; filter f_filter13 { facility(auth) and level(info); }; filter f_filter14 { facility(local2) and not match("pppd"); }; filter f_filter15 { facility(mail) and match("fetchmail"); }; filter f_filter18 { facility(authpriv) and match("useradd"); }; filter f_filter20 { match("apcupsd"); }; filter f_filter21 { match("syslog-ng"); }; filter f_filter22 { match("sshd"); }; filter f_filter23 { facility(local5); }; filter f_filter24 { facility(local4); }; # Bodybuilding # ------------------------------------------------------------- #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter1); destination(d_kern); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; log { source(s_sys); filter(f_filter9); destination(d_mailacct); }; log { source(s_sys); filter(f_filter10); destination(d_named); }; log { source(s_sys); filter(f_filter11); destination(d_iptbl); }; log { source(s_sys); filter(f_filter12); destination(d_daemons); }; log { source(s_sys); filter(f_filter13); destination(d_authinfo); destination(d_mlal); }; log { source(s_sys); filter(f_filter14); destination(d_pop); }; log { source(s_sys); filter(f_filter15); destination(d_fetchm); }; log { source(s_sys); filter(f_filter18); destination(d_useradd); }; log { source(s_sys); filter(f_filter20); destination(d_apcupsd); }; log { source(s_sys); filter(f_filter21); destination(d_syslogngd); }; log { source(s_sys); filter(f_filter22); destination(d_mlal); }; log { source(s_sys); filter(f_filter23); destination(d_smartd); }; log { source(s_sys); filter(f_filter24); destination(d_drwebp); }; -- Serge P. Torop St.Petersburg, Russia

3 3

Does -d imply -F
by Albert Chin 12 Dec '06

12 Dec '06

According to the admittedly out-of-date man page: -d, --debug Set "debug mode". Prints out various messages to aid in debugging and stops it from becoming a daemon. To activate debugging in the yacc parser, either use this option twice or combine with -v. -F, --foreground Don't fork into background. Do, does -d imply -F as -d "stops it from becoming a daemon."? Looking at src/main.c, this does not seem to be the case. do_fork=0 only when -F is specified. -- albert chin (china(a)thewrittenword.com)

2 1

syslog-ng make errors on RHEL4 x86_64
by James Young 12 Dec '06

12 Dec '06

When attempting to perform make on RHEL4 x86_64 for syslog-ng 2.0.0 I recieve the following errors. I have managed to find a previous post in July which mentions patching the source, however the attachment has been 'scrubbed' from the message. Anyone able to point me toward what I need to be doing to resolve these errors below? libsyslog-ng.a(misc.o)(.text+0x3d1): In function `resolve_hostname': /var/tmp/syslog-ng-2.0.0/src/misc.c:178: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x97): In function `log_stamp_format': /var/tmp/syslog-ng-2.0.0/src/logmsg.c:111: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x37e): In function `log_msg_ref': /var/tmp/syslog-ng-2.0.0/src/logmsg.c:489: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x41f): In function `log_msg_unref': /var/tmp/syslog-ng-2.0.0/src/logmsg.c:503: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0xd8b): In function `log_msg_ack_block_end': /var/tmp/syslog-ng-2.0.0/src/logmsg.c:623: undefined reference to `g_return_if_fail_warning' libsyslog-ng.a(logpipe.o)(.text+0x58): In function `log_pipe_ref': /var/tmp/syslog-ng-2.0.0/src/logpipe.c:38: undefined reference to `g_assert_warning' libsyslog-ng.a(logpipe.o)(.text+0xa9): In function `log_pipe_unref': /var/tmp/syslog-ng-2.0.0/src/logpipe.c:47: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x9f): In function `log_endpoint_free': /var/tmp/syslog-ng-2.0.0/src/center.c:90: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x18d): In function `log_connection_new': /var/tmp/syslog-ng-2.0.0/src/center.c:132: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x358): In function `log_template_ref': /var/tmp/syslog-ng-2.0.0/src/templates.c:169: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x3bd):/var/tmp/syslog-ng-2.0.0/src/templates.c:180: more undefined references to `g_assert_warning' follow collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/var/tmp/syslog-ng-2.0.0/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/var/tmp/syslog-ng-2.0.0' make: *** [all] Error 2

3 4

Trouble with timezone()
by anthony lineham 11 Dec '06

11 Dec '06

Hi, I'm trying to convert the time information in messages so they match the timezone offset of a remote device. Initially I was using time_zone(). This seemed to work ok until I tried and offset of greater than 12hours, which failed. It occurred to me that this utility is intended convert messages initially with GMT time to a GMT +/- offset time hence only +/-12 is required. What I want to be able to do is make a coversion relative to local time, so I need to be able to handle an offset of up 23 hours. I'm trying to use timezone(), which is supposed to take an offset value in seconds. However I can't work out the syntax. For a 2 hour offset I've tried: timezone(7200) timezone("7200") timezone("+7200") timezone(+7200) For each of these I get config parsing errors. Can anyone help me out please? Anthony

2 5

Advice on keeping hostnames/using dns
by Hari Sekhon 07 Dec '06

07 Dec '06

Hi, I'd like some advice on what I should do on my logserver regarding hostnames. I've currently got keep_hostnames(no) use_dns(yes) in order to get accurate and consistent hostnames but I'd like to consider just skipping the whole dns check rewriting thing and use keep_hostnames(yes) use_dns(no) The only issue I can see from this is that the hostname gets logged according to the packet. I'm reasonably confident that most machines will report the right name in their logs to the logserver but I also think that it makes it all too possible to screw up the logserver maliciously since any old junk that is sent to the port is put into the logs so you could hammer the integrity of the logs just by sending loads of bogus logs from a machine with the name set to that of any other machine on the network. Got any views on this? All opinions welcome. Thanks Hari -- Hari Sekhon

8 13

RE: [syslog-ng] logrotate again...
by Justin Randall 07 Dec '06

07 Dec '06

Hello, If the sed script was copied without first reviewing the actual format of Syslog messages, then yes this would happen. The sed scripts were examples of how to write the sed script, the actual regex for the date "November 15th" are completely different in the actual log file. Syslog messages use the time format "Dec 3 04:29:20" at the beginning of each line. This means that you would use a date format like the above. Likely the regex you would want to use is something more like "15 +Nov". This implies "15", then 1 or more white spaces, and then "Nov". In the future it is always good practice to test any procedure you get from a mailing list. In this case, looking at the Syslog message format should have obviously shown that the example originally submitted would not work. Basically what happened was that the sed script started at "." (match any character) and until "15 Nov" and deleted everything in between. Since "15 Nov" never appeared in the log file, everything was deleted. Since this is not a discussion for the Syslog-NG mailing list and more of a regular System Administration problem, if you'd like to discuss this further let's take this off this mailing list. Feel free to email me at djsykz(a)hotmail.com. Regards, Justin. -----Original Message----- From: Vadim Pushkin [mailto:wiskbroom@hotmail.com] Sent: Wednesday, December 06, 2006 1:42 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng] logrotate again... Well, this did not work, but it was sucessful at wiping out the entire contents of the file altogether :-( Regards, .vp >From: "Justin Randall" <jrandall(a)comwave.net> >Slight correction on the command syntax: > > > find /var/log -type f -exec sed -if <sed script filename> {} \; > >Should be > >find /var/log -type f -exec sed -f <sed script filename> --in-place {} >\; > >Cheers. > >-----Original Message----- >From: Justin Randall >Sent: Wednesday, December 06, 2006 11:21 AM >To: 'Syslog-ng users' and developers' mailing list' >Subject: RE: [syslog-ng] logrotate again... > > >find /var/log -type f -exec sed -i '/15 Nov/d' {} \; should work - is >untested, though :) > >If I'm not mistaken this will only remove lines containing '15 Nov'. If >you want something that will eliminate all logs prior to that date you >could write a sed script like the following: > >= begin sed script = >/./,/15 Nov/{ >d >} >= end sed script = > >If you had another date range in mind you could also do the following: > >= begin sed script = >/13 Nov/,/15 Nov/{ >d >} >= end sed script = > >Once you have your sed script simply invoke it similar to the above >method: > >find /var/log -type f -exec sed -if <sed script filename> {} \; > >Hope this helps, > >Justin. > >-----Original Message----- >From: Andrej Ricnik-Bay [mailto:andrej.groups@gmail.com] >Sent: Tuesday, December 05, 2006 3:44 PM >To: Syslog-ng users' and developers' mailing list >Subject: Re: [syslog-ng] logrotate again... > >On 12/6/06, Vadim Pushkin <wiskbroom(a)hotmail.com> wrote: > > > 2. The other issue that I am having is that I wish to rotate now, my > > filesystem is fill, but since I did not rotate, all of my logfiles are >one. > > How can I prune them of any data prior to say 15 Nov for *each* >logfile? >find /var/log -type f -exec sed -i '/15 Nov/d' {} \; >should work - is untested, though :) > > > > Thank you again, > > > > .vp >Cheers _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] logrotate again...
by Justin Randall 06 Dec '06

06 Dec '06

Slight correction on the command syntax: > find /var/log -type f -exec sed -if <sed script filename> {} \; Should be find /var/log -type f -exec sed -f <sed script filename> --in-place {} \; Cheers. -----Original Message----- From: Justin Randall Sent: Wednesday, December 06, 2006 11:21 AM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] logrotate again... >find /var/log -type f -exec sed -i '/15 Nov/d' {} \; should work - is untested, though :) If I'm not mistaken this will only remove lines containing '15 Nov'. If you want something that will eliminate all logs prior to that date you could write a sed script like the following: = begin sed script = /./,/15 Nov/{ d } = end sed script = If you had another date range in mind you could also do the following: = begin sed script = /13 Nov/,/15 Nov/{ d } = end sed script = Once you have your sed script simply invoke it similar to the above method: find /var/log -type f -exec sed -if <sed script filename> {} \; Hope this helps, Justin. -----Original Message----- From: Andrej Ricnik-Bay [mailto:andrej.groups@gmail.com] Sent: Tuesday, December 05, 2006 3:44 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] logrotate again... On 12/6/06, Vadim Pushkin <wiskbroom(a)hotmail.com> wrote: > 2. The other issue that I am having is that I wish to rotate now, my > filesystem is fill, but since I did not rotate, all of my logfiles are one. > How can I prune them of any data prior to say 15 Nov for *each* logfile? find /var/log -type f -exec sed -i '/15 Nov/d' {} \; should work - is untested, though :) > Thank you again, > > .vp Cheers _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1