- syslog-ng - lists.balabit.hu

DJBDNS&SYslog-ng
by Hamilton Vera 29 Apr '06

29 Apr '06

How to make djbdns and syslog-ng to work together? Thanks

1 0

service syslog-ng does not support chkconfig
by wayne yu 27 Apr '06

27 Apr '06

Hi: I'm new to syslog-ng, and I really need help for the error message [root@localhost init.d]# chkconfig --add syslog-ng service syslog-ng does not support chkconfig thanks in advance for any help --------------------------------- Love cheap thrills? Enjoy PC-to-Phone calls to 30+ countries for just 2¢/min with Yahoo! Messenger with Voice.

2 1

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 26 Apr '06

26 Apr '06

Here you go: 1 # syslog-ng configuration file.$ 2 #$ 3 # This should behave pretty much like the original syslog on RedHat Linux 9.$ 4 # But it could be configured a lot smarter.$ 5 #$ 6 # See syslog-ng(8) and syslog-ng.conf(5) for more information.$ 7 $ 8 options {$ 9 sync (0);$ 10 time_reopen (10);$ 11 log_fifo_size (1000);$ 12 long_hostnames (on);$ 13 use_dns (yes);$ 14 use_fqdn (no);$ 15 create_dirs (no);$ 16 owner(mdirect);$ 17 group(mdirect);$ 18 keep_hostname (yes);$ 19 log_msg_size(20480);$ 20 time_sleep(30);$ 21 };$ 22 $ 23 $ 24 #source s_sys {$ 25 # pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal();$ -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Roberto Nibali Sent: April 26, 2006 10:41 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() Vaibhav Goel wrote: > Still can't figure this one out. So far, I have compiled and installed > 1.6.9 and 1.6.10 and keep getting the same error. > > Anyone?!?!? One thing that sometimes bites people is a stupid control character inside a config file. Could you post the output of following command, please? cat -An mpt-status.c | head -25 Reducing the config file to a bare reproducable set of entries would help us as well. Regards, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 2

Any non-commercial Windows tcp clients?
by Davis, Jacob 26 Apr '06

26 Apr '06

I've been doing some digging around and have found references to several windows syslog clients (snare, ntsyslog, kiwi, etc..) but nothing I have found is both capable of using TCP ports instead of the standard UDP, and also non-commercial. The reason I ask is that I am intent on using SSL or SSH to tunnel connections to the log host and I don't think that UDP is an option in that case. Does such a solution exist? Thanks, -Jake

1 0

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 26 Apr '06

26 Apr '06

I cannot locate the mpt-status.c file in the 1.6.10 source tree. Syslog-ng gives a syntax error in a config file which has just this: options { time_sleep(30); }; (it works fine if you replace sleep with reap though) -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Roberto Nibali Sent: April 26, 2006 10:41 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() Vaibhav Goel wrote: > Still can't figure this one out. So far, I have compiled and installed > 1.6.9 and 1.6.10 and keep getting the same error. > > Anyone?!?!? One thing that sometimes bites people is a stupid control character inside a config file. Could you post the output of following command, please? cat -An mpt-status.c | head -25 Reducing the config file to a bare reproducable set of entries would help us as well. Regards, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 26 Apr '06

26 Apr '06

Still can't figure this one out. So far, I have compiled and installed 1.6.9 and 1.6.10 and keep getting the same error. Anyone?!?!? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of John Morrissey Sent: April 25, 2006 2:13 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() On Tue, Apr 25, 2006 at 01:52:30PM -0700, Vaibhav Goel wrote: > The rest of the file is just a bunch of source, destination, filter and > log entries for various stuff > > Also: > [root@clxd01md syslog-ng]# strings /sbin/syslog-ng | grep time_sleep > time_sleep > > So looks like there could be some time_sleep code in the binary at > least... True. You posted the output of syslog-ng -V before (1.6.10), and I definitely see the code in the final 1.6.10 tarball. strings(1) shows time_sleep text on my working syslog-ng binaries, and I can't find any reason it wouldn't be compiled in. Sorry, I'm not sure what to say. Baszi? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

FQDN based on destination
by Chris Whipple 25 Apr '06

25 Apr '06

Is there a way to change the use_fqdn() option based on the destination so that one receives the short host name an the other receives the FQ name? I'm using version 1.6.10. example: options { use_fqdn (yes) ... }; destination d_logfile { file("somelogfile") ; }; destination d_rmtserver { tcp("rmtserver.domain.com" port(514)); use_fqdn(no); }; Thank you, Chris Whipple Sr. Security Analyst Unix Security Group The Hertz Corporation 5601 NW Expressway Oklahoma City, OK 73132, USA cwhipple(a)hertz.com --------------- This message (including attachments) may contain information that is privileged, confidential or protected from disclosure. If you are not the intended recipient, you are hereby notified that dissemination, disclosure, copying, distribution or use of this message or any information contained in it is strictly prohibited. If you have received this message in error, please immediately notify the sender by reply e-mail and delete this message from your computer. Although we have taken steps to ensure that this e-mail and attachments are free from any virus, we advise that in keeping with good computing practice the recipient should ensure they are actually virus free. ---------------

3 4

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 25 Apr '06

25 Apr '06

BTW I just removed the time_sleep(30); from the file below to restart syslog-ng. But as soon as I put it in there, I get the syntax error... syntax error at 20 Parse error reading configuration file, exiting. (line 20) options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); owner(mdirect); group(mdirect); keep_hostname (yes); log_msg_size(20480); time_sleep(30); }; -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Vaibhav Goel Sent: April 25, 2006 1:53 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] time_sleep() I can't post the whole thing since its too big but I am posting the relevant portion of it: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); owner(mdirect); group(mdirect); keep_hostname (yes); log_msg_size(20480); }; The rest of the file is just a bunch of source, destination, filter and log entries for various stuff Also: [root@clxd01md syslog-ng]# strings /sbin/syslog-ng | grep time_sleep time_sleep So looks like there could be some time_sleep code in the binary at least... -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of John Morrissey Sent: April 25, 2006 1:48 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() On Tue, Apr 25, 2006 at 01:00:17PM -0700, Vaibhav Goel wrote: > I did exactly that... > > [root@clxd01md syslog-ng]# /etc/init.d/syslog-ng restart > Shutting down system logger: [ OK ] > Starting system logger: syntax error at 20 > Parse error reading configuration file, exiting. (line 20) > [FAILED] > [root@clxd01md syslog-ng]# cat /etc/syslog-ng/syslog-ng.conf | grep time > time_reopen (10); > time_sleep(30); > > [root@clxd01md syslog-ng]# /sbin/syslog-ng -V > syslog-ng 1.6.10 > > > Am I doing something wrong? Strange. I backported the time_sleep change to the Debian package I'm running (1.6.9) so I can't speak for the pristine 1.6.10 source, but it's been working fine for us. I glanced at the 1.6.10 tarball and see some time_sleep code there. Could you post your entire syslog-ng.conf? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 25 Apr '06

25 Apr '06

Hi John... I did exactly that... [root@clxd01md syslog-ng]# /etc/init.d/syslog-ng restart Shutting down system logger: [ OK ] Starting system logger: syntax error at 20 Parse error reading configuration file, exiting. (line 20) [FAILED] [root@clxd01md syslog-ng]# cat /etc/syslog-ng/syslog-ng.conf | grep time time_reopen (10); time_sleep(30); [root@clxd01md syslog-ng]# /sbin/syslog-ng -V syslog-ng 1.6.10 Am I doing something wrong? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of John Morrissey Sent: April 25, 2006 12:38 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() On Tue, Apr 25, 2006 at 11:44:29AM -0700, Vaibhav Goel wrote: > I just installed syslog-ng 1.6.10 and cannot figure out how to use the > time_sleep() option in the conf file. Any ideas? We are having some > nasty cpu spikes because of lots of parallel connections to syslog-ng > and hoping this will solve the issue. It's just an option, i.e.: options { time_sleep(30); } john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

time_sleep()
by Vaibhav Goel 25 Apr '06

25 Apr '06

Hi all I just installed syslog-ng 1.6.10 and cannot figure out how to use the time_sleep() option in the conf file. Any ideas? We are having some nasty cpu spikes because of lots of parallel connections to syslog-ng and hoping this will solve the issue. Thanks!

2 1