- syslog-ng - lists.balabit.hu

timezones
by Szeti, Balazs 10 Nov '06

10 Nov '06

Hello! I'm trying to log messages with ISO timestamps from different timezones. Example through TCP: <140>2006-11-05T05:15:15+01:00 1 2 3 <140>2006-11-05T05:15:15+02:00 1 2 3 <140>2006-11-05T05:15:15+03:00 1 2 3 The syslog-ng's node is in +01:00 timzone. I left all the time_zone() on default. Template used: template t_year { template("$S_ISODATE $R_ISODATE $S_HOUR: $MSGONLY\n"); }; Result in the log: 2006-11-05T05:15:15.000000+01:00 2006-11-09T16:12:10+01:00 05: 2 3 2006-11-05T07:15:15.000000+02:00 2006-11-09T16:11:41+01:00 07: 2 3 2006-11-05T09:15:15.000000+03:00 2006-11-09T16:12:37+01:00 09: 2 3 There's nothing wrong with the R_ISODATE, but I don't understand the S_ISODATE. When I log with the syslog-ng node timezone it writes the right value, but when I change the timezone in the TCP message the S_HOUR increases! I would like to see the original timestamp from the message and the R_ISODATE right next to each other. Why is the S_ISODATE increased? Can S_HOUR now be used in file name templates??? Thanks in advance, Balazs Szeti

2 5

syslog-ng to MySQL: write decimal code of severity level in column
by Tadej Bregar 10 Nov '06

10 Nov '06

Hello, I'm using syslog-ng 2.0 rc4 with Php-Syslog-NG 2.9.2a on RHEL4 with MySQL 5.0.24a. I'm feeding MySQL server through UNIX pipe and everything goes well - BUT I've got a few questions. This is not strictly syslog-ng problem, as I'm also using php-syslog-ng in my setup (php-syslog-ng database schema for MySQL), but I'll ask here on this list anyway: 1.How can I configure syslog-ng to write decimal code of severity (see RFC3164) in column "level" (or "priority") of table "logs" in database "syslog"? Is this possible to achieve somehow? 2. Why are we logging the same information twice (the same data gets written in column "priority" and "level")? The ideal setup would be to write decimal code of severity level in column "level" and corresponding word string (eg. info or warning or crit ...) in column "priority". Using php-syslog-ng in this case, we could order syslog messages by priority properly (sql query ... ORDER BY level ASC .... orders our messages by alphabetical order) Now we can't (!!) because in ascending mode we get alert (character A) first and warning (character W) last, but we should get nice progression like: debug, info, notice, warning, error, crit, alert, emerg. Just in case, I'm attaching a part of syslog-ng.conf file: --------------------- destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$R_YEAR-$R_MONTH-$R_DAY $R_HOUR:$R_MIN:$R_SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; --------------------- Thanks for any info, Tadej

1 0

Alternate logging destination
by Szeti, Balazs 06 Nov '06

06 Nov '06

Hello! I would like to design a centralized logging system with 50 edge nodes and one center. It's quiet important to have all the logs even if the center is unreachable. Is there a way to configure syslog-ng to use an alternate destination? For example if the centralized TCP destionation server is down, the edge node syslog-ng may log in to a local file, so the logs can be reached later manually. When the center server in online again syslog-ng may log online again. Any ideas? Thanks in advance: Balazs

5 8

2.0.0 : make install doesn't install anything?
by Rob Munsch 06 Nov '06

06 Nov '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, i was reasonably sure that earlier versions make an /etc/syslog-ng and put a syslog-ng.conf in there as well as installing basic initscripts. My configure and make seem to exit cleanly, but make install doesn't... install. Yes, i am root. This is on a debian linux box with 2.6.16.29. I guess i could be misremembering, but i don't *think* i did that all by hand last time..? And yes, i see the scripts in debian/ as well. I'm just making sure there's nothing Odd about make install's behaviour before i move them manually. Thanks, - -- Rob Munsch Solutions For Progress IT www.solutionsforprogress.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFT18YBvBcJFK6xYURAoZsAJ43DCm3UI21VyRXGYyHOFqQcuABRwCdEx3w xpY/T1qymgA+skAdx+Nu/6E= =2UrK -----END PGP SIGNATURE-----

1 1

Re: [syslog-ng] sysutils/syslog-ng/files/syslong-ng.sh.in patch
by Valdis.Kletnieks＠vt.edu 06 Nov '06

06 Nov '06

On Mon, 06 Nov 2006 09:21:43 EST, "Brian A. Seklecki" said: > Yep. I sent about 75 messages the other night well under the influence > of a *LOT* of alcohol. >:} Ahh. That explains the jpeg of you and the llamas. :)

1 0

sysutils/syslog-ng/files/syslong-ng.sh.in patch
by Brian A. Seklecki 06 Nov '06

06 Nov '06

This is a nice little patch we use to purge out /dev/klog after /etc/rc.d/dmesg and before /usr/local/etc/rc.d/syslog-ng.sh. It's useful for shops that translate user.info facility/priority syslog messages into SMS/E-Mail via a log{} mechanism (i.e., hardware error messages from the kernel, like some flunky in the NOC plugging a keyboard into your system). It lets you avoid 200 lines of boot messages in log(9) making their way into your log{} mechanism or into your pager. We want to feed it upstream because we think others will find it useful. ~BAS $ diff -u /usr/ports/sysutils/syslog-ng/files/syslog-ng.sh.in syslog-ng.sh.in --- /usr/ports/sysutils/syslog-ng/files/syslog-ng.sh.in Wed Mar 29 16:20:19 2006 +++ syslog-ng.sh.in Fri Nov 3 20:32:59 2006 @@ -14,6 +14,8 @@ #syslog_ng_enable="YES" # +syslog_ng_purgeklog=${syslog_ng_purgeklig-"NO"} + . %%RC_SUBR%% name=syslog_ng @@ -23,6 +25,11 @@ required_files=%%PREFIX%%/etc/syslog-ng/syslog-ng.conf pidfile=/var/run/syslog.pid extra_commands=reload + +if checkyesno syslog_ng_purgeklog; then + start_precmd="echo \"Purging klog(9)\" && sysctl -w kern.msgbuf_clear=1 $start_precmd"; +fi + stop_postcmd=stop_postcmd load_rc_config $name ---- l8* -lava (Brian A. Seklecki - Pittsburgh, PA, USA) http://www.spiritual-machines.org/ "...from back in the heady days when "helpdesk" meant nothing, "diskquota" meant everything, and lives could be bought and sold for a couple of pages of laser printout - and frequently were."

2 1

syslog-ng 2.0.0 released
by Balazs Scheidler 03 Nov '06

03 Nov '06

Hi, I'm proud to announce that the first stable version in the 2.0.x series, with a version number of 2.0.0 has been released and uploaded to our website. Those following the 1.9.x and 2.0rcX releases should not expect much changes between 2.0rc4 and 2.0.0, a few fixes here and there. >From now on, syslog-ng 1.6.x is strictly in maintenance mode, my efforts on syslog-ng will concentrate on the 2.0.x branch. The list of user-visible changes in 2.0.0 since 2.0rc4: 2.0.0 Sat, 28 Oct 2006 17:32:50 +0200 Bugfixes: * Fixed some compilation warnings when using gcc4 * Fixed a problem in restarting program destinations, that could cause several instance of the program to run. * Fixed a UNIX domain socket format issue that sometimes caused a memory dump to be displayed in place of the socket name. * Fixed a bug in handling broken destination connections. Other changes: * Documentation updates. -- Bazsi

1 0

Re: logs written twice
by G.W. Haywood 03 Nov '06

03 Nov '06

Hi there, Damn. Too much of a hurry, missed the subject line the first time. On Wed, 1 Nov 2006 Nick Baronian wrote: > 2. logs written twice (Nick Baronian) > I setup a syslog-ng server to get logs from various boxes and devices. > I think I am a little confused about the correct way to set this up. > I am seeing a lot of logs getting written twice. > Is there a way I can duplicate the name schema the remote box is using I don't know exactly what you mean by that, and I do't think I'd know the answer if I did. :) > [snip] > filter pump_renewal { not program("pumpd") or not level(info,debug); }; > filter imap_debug { not program("imapd") or not level(info,debug); }; > filter ipop3_debug { not program("ipop3d") or not level(info,debug); }; > filter sshd_debug { not program("sshd") or not level(debug); }; > filter f_attack_alert { match("attackalert"); }; > filter f_ssh_login_attempt { > program("sshd.*") > and match("(Failed|Accepted)") > and not match("Accepted (hostbased|publickey) for > (root|zoneaxfr) from (10.4.3.1)"); }; > [snip] If I understand what you're trying to so, I don't think you're approaching this the right way at all. Think of a filter as being like a sieve. You keep what's filtered because you want it, you don't throw it away by 'filter'ing it out. Your filter 'sshd_debug' isn't being referenced at all, so it won't give you any output. If I wanted to see ssh debug messages (assuming that the ssh daemon was logging anything at the DEBUG level) then the filter I would use would be something like filter f_sshd_debug { program("sshd") and level(debug); }; log { source(src); filter(f_sshd_debug); destination(whatever); }; The problem with using 'or' is that not program("sshd") or not level(debug) will give you stuff that ISN'T sshd if it also ISN'T debug. Check out deMorgan's theorem on the Web. If I've got the wrong end of the stick here, a flame to my personal email address is in order but one to the list isn't. :) -- 73, Ged.

3 3

Re: logs written twice
by G.W. Haywood 02 Nov '06

02 Nov '06

Hi there, On Thu, 2 Nov 2006 Nick Baronian wrote: > > > Is there a way I can duplicate the name schema the remote box is using > > > > I don't know exactly what you mean by that, and I do't think I'd know > > the answer if I did. :) > > What I mean is if I have two boxes I want to log to this syslog-ng > server, one is an old Unix box that is logging *.info;mail.none > locally to /var/adm/syslog/syslog.log and the other is a RH Linux box > that logs *.info;mail.none locally to /var/log/messages is there a way > the remote syslog-ng server can be configured to write the > *.info;mail.none for the Linux box to a messages file and for logs it > receives from the Unix box to a syslog.log file? That should be no problem at all, but I think you're going to have to knuckle down and read the documentation. You'd tell the two boxes to log to the logging server and create a few rules on the logging server which log to different places depending on which of the two boxes sent the log message. If I were doing it, I'd have the two boxes decide what to log and the logging server decide only where (which file) to log it in. Otherwise you might create a lot of network traffic which contained information that would be discarded by the logging server. You seem to attach some significance to the names of these logfiles. Is there a reason for that? -- 73, Ged.

2 1

RE: [syslog-ng] help- Problem with TCP Based CentralizedLogServer using Syslog-ng
by Padmanabhan, Rajeesh (GE Healthcare) 02 Nov '06

02 Nov '06

Thanks Nate. I had set the max connections to 1000 already. Still it was same issue. Now I set so_rcvbuf(500) in tcp source( Basically increased the recive buffer size). After that its not crashing that frequently. It takes 1 or 2 days to crash. Please help. -Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Nathan Campi Sent: Tuesday, October 31, 2006 11:43 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] help- Problem with TCP Based CentralizedLogServer using Syslog-ng Check the logs from syslog-ng on the central server. Could be that you need to increase the max connections to your tcp source or increase an OS limit like open file descriptors. -- Nate Campi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0