- syslog-ng - lists.balabit.hu

RE: [syslog-ng] Newbie Question
by William Bell 21 Aug '06

21 Aug '06

You should probably create multiple sources. Like: source remote { udp(ip("0.0.0.0") port(514)); }; Then send the remote files to a nice archive directive destination ala: destination remotelogs { file("/var/REMOTE/$HOST.log" owner(root) group(root) perm(0755) dir_perm(0755) create_dirs(yes)); }; Finish it up with its own log directive like: log { source(remote); destination(remotelogs); }; Adding any filters you want to the log directive above. I hope this helps. William L. Bell II CWIE Security Dept. _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Donald Rush Sent: Monday, August 21, 2006 10:18 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Newbie Question All, I am working on creating a logging host for some network hardware. Being new to lunix and syslog-ng I am a little confused to how to keep the remote syslog messages from showing up in the system log files. I had to rem out the messages and and localmessages do to they are filling to fast. Any advice would be greatly appreciated. Don R. rushd-linux:/home/rushd # cat /etc/syslog-ng/syslog-ng.conf # # /etc/syslog-ng/syslog-ng.conf # # Automatically generated by SuSEconfig on Thu Aug 17 16:58:59 PDT 2006. # # PLEASE DO NOT EDIT THIS FILE! # # you can modify /etc/syslog-ng/syslog-ng.conf.in instead # # # # File format description can be found in syslog-ng.conf(5) # and /usr/share/doc/packages/syslog-ng/syslog-ng.txt. # # # Global options. # options { long_hostnames(off); sync(0); perm(0640); stats(3600); }; # # 'src' is our main source definition. you can add # more sources driver definitions to it, or define # your own sources, i.e.: # #source my_src { .... }; # source src { # # include internal syslog-ng messages # note: the internal() soure is required! # internal(); # # the following line will be replaced by the # socket list generated by SuSEconfig using # variables from /etc/sysconfig/syslog: # unix-dgram("/dev/log"); # # uncomment to process log messages from network: # udp(ip("0.0.0.0") port(514)); }; # # Filter definitions # filter f_iptables { facility(kern) and match("IN=") and match("OUT="); }; filter f_console { level(warn) and facility(kern) and not filter(f_iptables) or level(err) and not facility(authpriv); }; filter f_newsnotice { level(notice) and facility(news); }; filter f_newscrit { level(crit) and facility(news); }; filter f_newserr { level(err) and facility(news); }; filter f_news { facility(news); }; filter f_mailinfo { level(info) and facility(mail); }; filter f_mailwarn { level(warn) and facility(mail); }; filter f_mailerr { level(err, crit) and facility(mail); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_local { facility(local0, local1, local2, local3, local4, local5, local6, local7); }; filter f_acpid { match('^\[acpid\]:'); }; filter f_netmgm { match('^NetworkManager:'); }; filter f_messages { not facility(news, mail) and not filter(f_iptables); }; filter f_warn { level(warn, err, crit) and not filter(f_iptables); }; filter f_alert { level(alert); }; # # Most warning and errors on tty10 and on the xconsole pipe: # destination console { file("/dev/tty10" group(tty) perm(0620)); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole" group(tty) perm(0400)); }; log { source(src); filter(f_console); destination(xconsole); }; # Enable this, if you want that root is informed immediately, # e.g. of logins: # #destination root { usertty("root"); }; #log { source(src); filter(f_alert); destination(root); }; # # News-messages in separate files: # destination newscrit { file("/var/log/news/news.crit" owner(news) group(news)); }; log { source(src); filter(f_newscrit); destination(newscrit); }; destination newserr { file("/var/log/news/news.err" owner(news) group(news)); }; log { source(src); filter(f_newserr); destination(newserr); }; destination newsnotice { file("/var/log/news/news.notice" owner(news) group(news)); }; log { source(src); filter(f_newsnotice); destination(newsnotice); }; # # and optionally also all in one file: # (don't forget to provide logrotation config) # #destination news { file("/var/log/news.all"); }; #log { source(src); filter(f_news); destination(news); }; # # Mail-messages in separate files: # destination mailinfo { file("/var/log/mail.info"); }; log { source(src); filter(f_mailinfo); destination(mailinfo); }; destination mailwarn { file("/var/log/mail.warn"); }; log { source(src); filter(f_mailwarn); destination(mailwarn); }; destination mailerr { file("/var/log/mail.err" fsync(yes)); }; log { source(src); filter(f_mailerr); destination(mailerr); }; # # and also all in one file: # destination mail { file("/var/log/mail"); }; log { source(src); filter(f_mail); destination(mail); }; # # acpid messages in one file: # destination acpid { file("/var/log/acpid"); }; log { source(src); filter(f_acpid); destination(acpid); flags(final); }; # # NetworkManager messages in one file: # destination netmgm { file("/var/log/NetworkManager"); }; log { source(src); filter(f_netmgm); destination(netmgm); flags(final); }; # # Cron-messages in one file: # (don't forget to provide logrotation config) # #destination cron { file("/var/log/cron"); }; #log { source(src); filter(f_cron); destination(cron); }; # # Some boot scripts use/require local[1-7]: # ##destination localmessages { file("/var/log/localmessages"); }; ##log { source(src); filter(f_local); destination(localmessages); }; # # All messages except iptables and the facilities news and mail: # ##destination messages { file("/var/log/messages"); }; ##log { source(src); filter(f_messages); destination(messages); }; # # Firewall (iptables) messages in one file: # destination firewall { file("/var/log/firewall"); }; log { source(src); filter(f_iptables); destination(firewall); }; # # Warnings (except iptables) in one file: # destination warn { file("/var/log/warn" fsync(yes)); }; log { source(src); filter(f_warn); destination(warn); }; # # Enable this, if you want to keep all messages in one file: # (don't forget to provide logrotation config) # #destination allmessages { file("/var/log/allmessages"); }; #log { source(src); destination(allmessages); }; destination logip { file("/data/logs/HOSTS/$HOST_FROM/$FACILITY/$YEAR$MONTH/$FACILITY$YEAR$M ONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; log { source(src); destination(logip); }; rushd-linux:/home/rushd #

2 1

Newbie Question
by Donald Rush 21 Aug '06

21 Aug '06

All, I am working on creating a logging host for some network hardware. Being new to lunix and syslog-ng I am a little confused to how to keep the remote syslog messages from showing up in the system log files. I had to rem out the messages and and localmessages do to they are filling to fast. Any advice would be greatly appreciated. Don R. rushd-linux:/home/rushd # cat /etc/syslog-ng/syslog-ng.conf # # /etc/syslog-ng/syslog-ng.conf # # Automatically generated by SuSEconfig on Thu Aug 17 16:58:59 PDT 2006. # # PLEASE DO NOT EDIT THIS FILE! # # you can modify /etc/syslog-ng/syslog-ng.conf.in instead # # # # File format description can be found in syslog-ng.conf(5) # and /usr/share/doc/packages/syslog-ng/syslog-ng.txt. # # # Global options. # options { long_hostnames(off); sync(0); perm(0640); stats(3600); }; # # 'src' is our main source definition. you can add # more sources driver definitions to it, or define # your own sources, i.e.: # #source my_src { .... }; # source src { # # include internal syslog-ng messages # note: the internal() soure is required! # internal(); # # the following line will be replaced by the # socket list generated by SuSEconfig using # variables from /etc/sysconfig/syslog: # unix-dgram("/dev/log"); # # uncomment to process log messages from network: # udp(ip("0.0.0.0") port(514)); }; # # Filter definitions # filter f_iptables { facility(kern) and match("IN=") and match("OUT="); }; filter f_console { level(warn) and facility(kern) and not filter(f_iptables) or level(err) and not facility(authpriv); }; filter f_newsnotice { level(notice) and facility(news); }; filter f_newscrit { level(crit) and facility(news); }; filter f_newserr { level(err) and facility(news); }; filter f_news { facility(news); }; filter f_mailinfo { level(info) and facility(mail); }; filter f_mailwarn { level(warn) and facility(mail); }; filter f_mailerr { level(err, crit) and facility(mail); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_local { facility(local0, local1, local2, local3, local4, local5, local6, local7); }; filter f_acpid { match('^\[acpid\]:'); }; filter f_netmgm { match('^NetworkManager:'); }; filter f_messages { not facility(news, mail) and not filter(f_iptables); }; filter f_warn { level(warn, err, crit) and not filter(f_iptables); }; filter f_alert { level(alert); }; # # Most warning and errors on tty10 and on the xconsole pipe: # destination console { file("/dev/tty10" group(tty) perm(0620)); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole" group(tty) perm(0400)); }; log { source(src); filter(f_console); destination(xconsole); }; # Enable this, if you want that root is informed immediately, # e.g. of logins: # #destination root { usertty("root"); }; #log { source(src); filter(f_alert); destination(root); }; # # News-messages in separate files: # destination newscrit { file("/var/log/news/news.crit" owner(news) group(news)); }; log { source(src); filter(f_newscrit); destination(newscrit); }; destination newserr { file("/var/log/news/news.err" owner(news) group(news)); }; log { source(src); filter(f_newserr); destination(newserr); }; destination newsnotice { file("/var/log/news/news.notice" owner(news) group(news)); }; log { source(src); filter(f_newsnotice); destination(newsnotice); }; # # and optionally also all in one file: # (don't forget to provide logrotation config) # #destination news { file("/var/log/news.all"); }; #log { source(src); filter(f_news); destination(news); }; # # Mail-messages in separate files: # destination mailinfo { file("/var/log/mail.info"); }; log { source(src); filter(f_mailinfo); destination(mailinfo); }; destination mailwarn { file("/var/log/mail.warn"); }; log { source(src); filter(f_mailwarn); destination(mailwarn); }; destination mailerr { file("/var/log/mail.err" fsync(yes)); }; log { source(src); filter(f_mailerr); destination(mailerr); }; # # and also all in one file: # destination mail { file("/var/log/mail"); }; log { source(src); filter(f_mail); destination(mail); }; # # acpid messages in one file: # destination acpid { file("/var/log/acpid"); }; log { source(src); filter(f_acpid); destination(acpid); flags(final); }; # # NetworkManager messages in one file: # destination netmgm { file("/var/log/NetworkManager"); }; log { source(src); filter(f_netmgm); destination(netmgm); flags(final); }; # # Cron-messages in one file: # (don't forget to provide logrotation config) # #destination cron { file("/var/log/cron"); }; #log { source(src); filter(f_cron); destination(cron); }; # # Some boot scripts use/require local[1-7]: # ##destination localmessages { file("/var/log/localmessages"); }; ##log { source(src); filter(f_local); destination(localmessages); }; # # All messages except iptables and the facilities news and mail: # ##destination messages { file("/var/log/messages"); }; ##log { source(src); filter(f_messages); destination(messages); }; # # Firewall (iptables) messages in one file: # destination firewall { file("/var/log/firewall"); }; log { source(src); filter(f_iptables); destination(firewall); }; # # Warnings (except iptables) in one file: # destination warn { file("/var/log/warn" fsync(yes)); }; log { source(src); filter(f_warn); destination(warn); }; # # Enable this, if you want to keep all messages in one file: # (don't forget to provide logrotation config) # #destination allmessages { file("/var/log/allmessages"); }; #log { source(src); destination(allmessages); }; destination logip { file("/data/logs/HOSTS/$HOST_FROM/$FACILITY/$YEAR$MONTH/$FACILITY$YEAR$M ONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; log { source(src); destination(logip); }; rushd-linux:/home/rushd #

1 0

Problem with hostnames (keep_hostname(no);)
by Dukes Clayton 17 Aug '06

17 Aug '06

Hiya folks, Here's the situation: All devices log to syslog-ng Syslog-ng then forwards logs to individual NMS systems, like Ciscoworks, etc. We're setting up a demo of Loglogic and are forwarding from the NG server to Loglogic. I'm getting the messages on the Loglogic side, but the originating hostnames are coming in as the NG server, not the actual device names (so it only sees one source) I've tried setting keep_hostname(no); but this doesn't seem to correct the problem. Any suggestions? TIA! Clayton

1 0

How many log files does syslog0ng support
by Walt Rich 17 Aug '06

17 Aug '06

We are running version 1.6.11 on Solaris 10, and have Syslog-ng configured to log to 7 different files. It logs just fine to 6 of them but will not for some reason log to the 7th destination which we created this week. Please advise. Thanks!

2 1

syslog-ng on AIX
by Brian Loe 15 Aug '06

15 Aug '06

I've installed syslog-ng on the AIX box and I thought I had pretty much replaced AIX's syslogd with it. However, it appears as though I'm missing a lot. Cron is logging to mail, for instance, and with the original syslogd it also logged to it. Syslog-ng is running and logging network messages, its own messages and that's it. So, the question, what more do I need to look at?

2 3

re:kernel message logging
by Bruce M. Penrod 14 Aug '06

14 Aug '06

Balazs Scheidler wrote: >On Fri, 2006-08-11 at 16:11 -0700, Bruce Penrod wrote: >> As a workaround, I tried using klogd with syslog-ng. I did turn off the >> syslog-ng source for /proc/kmsg. Now I don't see kernel messages on my >> console, but I don't get any kernel message logging either. Again, >> should this work? I don't see that there should be any special source >> definition in syslog-ng.conf for this to work. > In addition to Sandor's response, I'd like to add that this combination > should work, however klogd uses its own syslog() implementation instead > of using the one in libc, and it does not support > unix-stream() /dev/log, only unix-dgram(). That's probably the reason > why it does not work.Thanks to both Sandor and Balazs for the answers to my kernel logging questions. I did not know about /proc/sys/kernel/printk, or that dmesg had the capability to set it, just like klogd. Learn something new all the time. I was using the unix-stream source for /dev/log. Might be good to explain the need to use the datagram source for klogd in the reference docs, although I don't see why anyone would want to use it now. I only tried it because of the console logging issue, which Sandor's suggestion has solved nicely. Thanks for the quick responses. Bruce

1 0

kernel message logging
by Bruce Penrod 14 Aug '06

14 Aug '06

I've been using syslogd/klogd for years on linux systems and it seems to work as described in its docs, no issues. Unfortunately, it isn't being maintained and I now need ipv6 capability. Hence, syslog-ng. I like the straightforward configuration file structure, and with its emerging ipv6 capability, it seems like the future of open source syslogging, but I'm running into a little trouble making a seamless transition from syslogd/klogd. Apart from the problem I described in my previous post concerning the hostname being dropped from messages forwarded over udp6 to a loghost, I'm also running into a little difficulty with kernel message handling. It seems that the internal syslog-ng kernel message logging lacks a feature present in klogd that allows inhibiting kernel messages from appearing on the console, unless they are above a command line settable priority level. With syslog-ng, I seem to be getting all of the kernel messages coming out on /dev/console. I'm in an embedded environment using the mtd flash kernel drivers, which generate a lot of info level messages while erasing and writing to raw flash devices. klogd allows me to inhibit these quite nicely. Am I correct that syslog-ng lacks this capability, or just that I don't know how to configure it? As a workaround, I tried using klogd with syslog-ng. I did turn off the syslog-ng source for /proc/kmsg. Now I don't see kernel messages on my console, but I don't get any kernel message logging either. Again, should this work? I don't see that there should be any special source definition in syslog-ng.conf for this to work. Thanks, Bruce.

3 2

Re: [syslog-ng] How can i log messages from slapd in one file and, not /var/log/messages
by Gustavo Mendes de Carvalho 12 Aug '06

12 Aug '06

Fernando, I have this filters and destinatiosn in my configuration file: #============== source s_all { unix-stream("/dev/log"); internal(); }; destination d_ldap { file("/var/log/ldap.log"); }; filter f_syslog { not facility(auth, authpriv) and not match(slapd); }; filter f_ldap { match("slapd"); }; log { source(s_all); filter(f_syslog); destination(d_syslog); }; log { source(s_all); filter(f_ldap); destination(d_ldap); }; #=============== Tha's all that you need to send all ldap messages to one single file. Gustavo > Date: Fri, 11 Aug 2006 12:15:03 -0300 > From: "Fernando Loureiro" <loureiro.fernando(a)gmail.com> > Subject: [syslog-ng] How can i log messages from slapd in one file and > not /var/log/messages > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <a000e3310608110815i15f6a5b5rdc513481f3bae7ee(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi All, > > I want to know how can i have all my log messages inside a file called > slapd.log. > > Actually it´s logging most messages in /var/log/messages and some in > /var/log/slapd/slapd.log. > > I created the following filter for this daemon: > filter f_openldap { > program(slapd); }; > > And, by the way, i don´t know whenever to use which of those filter > functions. Can somebody explain me? > > > Att, > -- Fernando >

1 0

How can i log messages from slapd in one file and not /var/log/messages
by Fernando Loureiro 11 Aug '06

11 Aug '06

Hi All, I want to know how can i have all my log messages inside a file called slapd.log. Actually it´s logging most messages in /var/log/messages and some in /var/log/slapd/slapd.log. I created the following filter for this daemon: filter f_openldap { program(slapd); }; And, by the way, i don´t know whenever to use which of those filter functions. Can somebody explain me? Att, -- Fernando

1 0

(no subject)
by krishna y 09 Aug '06

09 Aug '06

Please remove my id from this list. Thanks, Krishna Y

1 0