- syslog-ng - lists.balabit.hu

syntax error 47
by Brian Long 06 Dec '06

06 Dec '06

Hello, I just upgraded my syslog-ng installation on debian and when it restarts I get this error: root@lancelot:/etc/init.d# /etc/init.d/syslog-ng restart Stopping system logging: syslog-ng not running. Starting system logging: syslog-ngsyntax error at 47 start failed. Syslog-ng works swimmingly on an identical debian system. Anyone know how I can get past this syntax error? Many thanks, Brian Long

3 2

RE: [syslog-ng] logrotate again...
by Justin Randall 06 Dec '06

06 Dec '06

>find /var/log -type f -exec sed -i '/15 Nov/d' {} \; should work - is untested, though :) If I'm not mistaken this will only remove lines containing '15 Nov'. If you want something that will eliminate all logs prior to that date you could write a sed script like the following: = begin sed script = /./,/15 Nov/{ d } = end sed script = If you had another date range in mind you could also do the following: = begin sed script = /13 Nov/,/15 Nov/{ d } = end sed script = Once you have your sed script simply invoke it similar to the above method: find /var/log -type f -exec sed -if <sed script filename> {} \; Hope this helps, Justin. -----Original Message----- From: Andrej Ricnik-Bay [mailto:andrej.groups@gmail.com] Sent: Tuesday, December 05, 2006 3:44 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] logrotate again... On 12/6/06, Vadim Pushkin <wiskbroom(a)hotmail.com> wrote: > 2. The other issue that I am having is that I wish to rotate now, my > filesystem is fill, but since I did not rotate, all of my logfiles are one. > How can I prune them of any data prior to say 15 Nov for *each* logfile? find /var/log -type f -exec sed -i '/15 Nov/d' {} \; should work - is untested, though :) > Thank you again, > > .vp Cheers _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: Tool to determine facility and severity from syslog packets
by G.W. Haywood 06 Dec '06

06 Dec '06

Hi there, On Wed, 6 Dec 2006 Paul Krizak wrote: > # The big monolithic syslog file > destination d_big_messages { > file ( > "/var/log/logs/messages.log" How about # The several separate syslog files destination d_separated_messages { file ( "/var/log/logs/$FACILITY.log" etc.? -- 73, Ged.

2 1

Rewriting log messages
by John Morrissey 05 Dec '06

05 Dec '06

We've been using the syslog-ng-anon patch[1] to rewrite log traffic (mainly to remove the redundant integer timestamp logged by qmail-pop3d via splogger(8)). We're looking at the upcoming syslog-ng 2.0 upgrade that's coming with the next Debian release (etch) and haven't been able to find an equivalent. I saw a request or two[2] for a feature like this, but don't see it in the latest syslog-ng source or docs. Is a feature like this planned, or is there another way I can go about rewriting log traffic? thanks, john [1] http://dev.riseup.net/privacy/syslog-ng-anon/ [2] https://lists.balabit.hu/pipermail/syslog-ng/2006-August/009129.html -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

4 3

Re: [syslog-ng] Tool to determine facility and severity from syslog packets
by G.W. Haywood 05 Dec '06

05 Dec '06

Hi there, On Tue, 5 Dec 2006, "Justin Shore" wrote: > Does anyone know of a tool to read the facility and severity info from > inbound syslog packets? I have a number of devices that are sending me > syslog info and I can't determine what facility they're using. >From your description I'm not sure exactly what your problems are, but _if_ you're using syslog-ng (if not, why not?!:) and _if_ I understand what you need then I think I would simply create two sets of temporary logfiles: one set would log everything at every severity and the other would log everything at every facility. Then I'd look in the logs to see if I recognized any of the output. A lot simpler and, er, more deterministic than hacking C and/or Perl. -- 73, Ged.

2 1

Tool to determine facility and severity from syslog packets
by Justin Shore 05 Dec '06

05 Dec '06

Does anyone know of a tool to read the facility and severity info from inbound syslog packets? I have a number of devices that are sending me syslog info and I can't determine what facility they're using. These devices can't be set to use specific facilities unfortunately. It would be ideal if I could read the data out of a raw dump from tcpdump or at least be able to bind it to 514/udp and prepend facility/severity info on each log line. Along the same lines it would be sweet if there was a way to rewrite the facility information in inbound syslog packets (based on source IP) before passing them to your favorite syslog server. This would be ideal for occasions such as this. Any info would be greatly appreciated. Thanks Justin

4 3

RE: [syslog-ng] Tool to determine facility and severity from
by Justin Shore 05 Dec '06

05 Dec '06

That's an interesting idea. I mess around with Perl when the need arrises but only on a very small scale; I'm not a programmer. I may try this some time. The whole proxy idea is a bit of an offshoot of my original problem (and the ultimate cause of the problem being a vendor that won't let you define the facility). I can see the problems of placing a proxy in between the loghost and sender. I figured syslog-ng could probably be bound to an oddball port so that the proxy could then listn on 514 and forward the rewritten messages to the oddball. This is terribly crucial though. I would be handy to mess with until I can convince these vendors to join the rest of the technological world and add this basic feature. I do need to be able to recognize the incoming messages somehow though so that I can stick them appropriate log file, store info level data in one log that is rotated weekly and kept for a year, and then store debug info in another log file that is rotated weekly and kept for only a single week. Otherwise drive space will become a major issue. For example, I have 1 firewall that is sending me 4.5GB of data each day. Without this basic log sorting and rotation setup I'd run out of drive space within a few days. I'll probably looking into matching each host by the source IP. That might be easiest in the long-term for these oddball hosts. I haven't set up syslog-ng so this could be an interesting experience. Thanks for the info Justin -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alexander Clouter Sent: Tuesday, December 05, 2006 3:48 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Tool to determine facility and severity from Hi, Heiko Blume <Heiko(a)Blume.AG> [20061205 10:32:19 +0100]: > > probably with the sniffer from ethereal.com > I would be more inclinded to use a Perl module: http://search.cpan.org/~sparsons/Net-Dev-Syslog-0.8.0/Syslog.pm It will create a mini-syslog server, decode the packets for you and then it would be trivial, if you know perl, to re-inject them with the same module or a different one: http://search.cpan.org/~saper/Sys-Syslog-0.18/Syslog.pm If you do not know perl you probably will find this is a nice mini-project to introduce you to the language. Its damn handy to be able to throw together a quick hack script to do jobs like this; means you no longer have to rely on the hope that someone else has done this already otherwise you would be out of options. The problem you are going to run into is that you have to have effectively a syslog proxy on another machine, or a second IP bound to your syslog core server. You cannot have this 'rewriter' and syslog-ng on the same box as both will be trying to listen on the same port; well you could pick different IP's for them to bind to though. By the sounds of it you really want to create a syslog-ng filter that has a list of IP's and hardcode in the facility and extract the severity there. To be honest if the facility is fixed then really there is no information you can extract that you could not determine "well it came from this IP therefore it has the *fixed* facility xyz". As for severity, its probably worth just grepping for keywords in the message for what you are looking for anyway. Thats where programs like swatch can help. Of course I might have missed completely what you are trying to accomplish, if so give a few more details and I'll try to help. Cheers Alex > regards, hb > > > Does anyone know of a tool to read the facility and severity info > > from inbound syslog packets? I have a number of devices that are > > sending me syslog info and I can't determine what facility they're > > using. These devices can't be set to use specific facilities > > unfortunately. It would be ideal if I could read the data out of a > > raw dump from tcpdump or at least be able to bind it to 514/udp and > > prepend facility/severity info on each log line. > > > > Along the same lines it would be sweet if there was a way to rewrite > > the facility information in inbound syslog packets (based on source > > IP) before passing them to your favorite syslog server. This would > > be ideal for occasions such as this. > > > > Any info would be greatly appreciated. Thanks > > > > Justin > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at > > http://www.campin.net/syslog-ng/faq.html > > > > > > > -- > Heiko(a)Blume.AG > > Cisco Certified Network Professional > Cisco Certified Design Professional > Juniper Certified Internet Specialist > SUN Certified System Administrator > > > Office: +49.30/4426309 > FAX: +49.30/48494354 > Mobile: +49.178/6662342 > www: http://www.blume.ag/IT/ > PHY: Knaackstrasse 6, 10405 Berlin, DE > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] Tool to determine facility and severity from syslogpackets
by Justin Shore 05 Dec '06

05 Dec '06

Thanks for the reply. I was hoping to avoid doing it the hard way if at all possible. Setting up 24 separate facilities, one at a time, and checking my logs for recognizable output doesn't sound like a fun Friday night. I figured someone out there had a trick to do this. All the syslog message generation tools have the ability to set facility and severity. Somewhere along the way I figured someone would have created a tool to help test those tools. I may do this if I absolutely have to but I'm still going to hold out for a while on a script or tool that can do this for me. Thanks for the info Justin -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of G.W. Haywood Sent: Tuesday, December 05, 2006 6:07 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Tool to determine facility and severity from syslogpackets Hi there, On Tue, 5 Dec 2006, "Justin Shore" wrote: > Does anyone know of a tool to read the facility and severity info from > inbound syslog packets? I have a number of devices that are sending > me syslog info and I can't determine what facility they're using. >From your description I'm not sure exactly what your problems are, but _if_ you're using syslog-ng (if not, why not?!:) and _if_ I understand what you need then I think I would simply create two sets of temporary logfiles: one set would log everything at every severity and the other would log everything at every facility. Then I'd look in the logs to see if I recognized any of the output. A lot simpler and, er, more deterministic than hacking C and/or Perl. -- 73, Ged. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Managing hostnames
by Olivier DUCROT 05 Dec '06

05 Dec '06

Hello list I¹m trying to configure syslog-ng with multiple mail server sources. It works fine, but I want a little more : The two line below shows what¹s happening : Dec 5 12:30:37 auxey postfix/smtpd[16360]: <- original log on the mail server Dec 5 12:30:37 auxey/auxey postfix/smtpd[16360]: <- log stored localy by syslog-ng shortname appeared twice separated by ³/² Here¹s my configuration : On auxey : /etc/syslog.conf mail.* @syslogserver.mydomain.com:514 On syslogserver.mydomain.com : /usr/local/etc/syslog-ng.conf options { create_dirs(yes); keep_hostname(no); }; source net { udp(); }; destination d_auxey { file("/var/log/tracemail/auxey.log"); }; destination d_hermes { file("/var/log/tracemail/hermes.log"); }; filter f_auxey { host("auxey"); }; filter f_hermes { host("hermes"); }; log { source(net); filter(f_auxey); destination(d_auxey); }; log { source(net); filter(f_hermes); destination(d_hermes); }; I tried with keep_hostname(no); and keep_hostname(yes);and without the option with the same result Any idea ?

1 1

syslog-ng 2.0.0 successful on Mac OS X Tiger
by Usman Wahid 04 Dec '06

04 Dec '06

Hi, I am getting the following error message, while compiling syslog-ng-2.0 on Mac OS X server 10.4.6, dnscache.c: In function 'dns_cache_key_hash': dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' make[2]: *** [dnscache.o] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 I am using eventlog-0.2.6, glib-2.12.4 and pkg-config-0.21. Any ideas to solve the problem? Regards. _________________________________________________________________ Get MSN Messenger emoticons and display pictures here! http://ilovemessenger.msn.com/?mkt=en-sg

2 1