- syslog-ng - lists.balabit.hu

Pix problem
by Damien Michau 28 Dec '05

28 Dec '05

Hi All ! I have some probleme ta log my pix's log into my syslog-ng server . i have mounted a Syslog-ng server to store my pix's log . But there is nothing in my pix.log i'have put this lines in my syslog-ng.conf source pix { udp(ip(10.60.10.111) port());}; destination pix { file("/var/log/pix.log"); }; log { source(pix);destination(pix); }; Have you one idea ? Thx Damien Michau Paris

4 5

What is my incoming data
by David Anderson 26 Dec '05

26 Dec '05

Hi, I am trying to set up syslog-ng to process data from my router on port 514, but I don't know the format of the data to be able to build filters. Is there any way to collect all data on 514 to a file? My current filters, etc are: # # the draytek router # filter f_draytek { host("router") and not match("Local User") and not match("virtual\Server"); }; filter f_draytek_DSL_1 { host("router") and match("DSL"); }; filter f_draytek_DSL_2 { host("router") and match("ADSL_Status"); }; filter f_draytek_PPP { host("router") and match("PoE"); }; destination draytek { file("/var/log/draytek/draytek.log"); }; destination draytek_null { file("/dev/null"); }; destination draytek_dsl { file("/var/log/draytek/draytek_dsl.log"); }; destination draytek_ppp { file("/var/log/draytek/draytek_ppp.log"); }; log { source(src); filter(f_draytek); destination(draytek); }; log { source(src); filter(f_draytek_DSL_1); destination(draytek_dsl); }; log { source(src); filter(f_draytek_DSL_2); destination(draytek_dsl); }; log { source(src); filter(f_draytek_PPP); destination(draytek_ppp); }; The log files have no info, so I presume there is something wrong somewhere (the conf is from someone who had everything working (apart from the /dev/null). It would presumably be easier if I could see the raw data. Originally the 514 data was being blocked by the firewall, but that is now cleared. Any help would be appreciated. -- Best regards, David mailto:dma@pern.co.uk

3 2

syslog-ng and selinux
by Ronny Vaningh 26 Dec '05

26 Dec '05

I just installed syslog-ng 1.6.9 on a centos 4.2 machine and syslog-ng doesnt start even after setting setsebool -P use_syslogng=1 I still get the error Starting system logger: Error opening file /proc/kmsg for reading (Permission denied) However it seems that syslog-ng tries to write to /prc/kmsg instead of reading it type=AVC msg=audit(1135510199.139:26): avc: denied { write } for pid=11942 comm="syslog-ng" name="kmsg" dev=proc ino=-268435446 scontext=root:system_r:syslogd_t tcontext=system_u:object_r:proc_kmsg_t tclass=file I'm a little bit puzzled why syslog-ng tries to write to /proc/kmsg instead of just reading messages of it. I can off course change the policy to allow writing but I feel that I must be doing something wrong here Thanks Ronny

2 2

log_msg_size in syslog-ng 1.6.7
by Nitass Sutaveephamochanon 26 Dec '05

26 Dec '05

Hello All, I got a problem about log_msg_size in syslog-ng 1.6.7. How can I know which process generates too long message to the syslog-ng? 2005:12:26-12:42:07 dent syslog-ng[6083]: Message length overflow, line is split, log_msg_size=2048 Please advice too. Thanks and regards, Nitass

1 0

convert logoutput to syslog
by Mark F 24 Dec '05

24 Dec '05

We use a commercial content management system that does not log to syslog but has its own log files. I can however modify where the log files are written via a config file directive. I'm interested in writing (or acquiring) a small program to convert the proprietary log output to something more syslog-ng like and redirect the stream to syslog-ng. I could probably use the logger command to accomplish the latter but how to convert the log output to use syslog facilities is the real question. Any advice, has anyone done something like this before? Thanks, -Mark

2 1

[buffering log messages]
by Jürgen Heil 20 Dec '05

20 Dec '05

hi everybody, we are using a central log (debian sarge) server running syslog-ng. all the hosts logging to the log server are running syslog-ng as well. does anybody know wheter syslog-ng on the hosts is able to buffer log messages to the local disk in case the logging server is not available? thank you for your help! juergen

2 1

match(regex) problem
by Staszek Pitucha 20 Dec '05

20 Dec '05

Hello I've tried to setup some filters lately (v1.9.7). There's a problem with regex character ^. For example I want to filter out "Accepted password" and my home ip from sshd logs, so I setup: filter f_sshd { (program("sshd") and not ( (match("Accepted password") and match("from 123\.456\.789\.012")) or // other rules )) or not program("sshd"); }; Works ok, but I want to filter only messages starting with "Accepted password", but "^Accepted password" doesn't work. Yes - I know - don't use ^, so it's faster. Anyway - "^Accepted" should work as a match pattern and it doesn't. (it should match only the "text" part of message, am I right?) TIA

3 4

Syslog-ng shutting down
by Ed Benckert 17 Dec '05

17 Dec '05

Recently, on a semi reliable schedule, our syslog-ng has started shutting down for no apparent reason. 3 nights in a row between 8:12pm and 8:20pm it shuts down. No, it doesnt crash, we get the 'syslog-ng version 1.6.9 going down' then it terminates. Before this, we had a few other times it just shut itself down... Now we havent changed anything on the system, theres no cron job running anywhere near that time... Has anyone else expeienced this? We've be running syslog-ng for 18 months now and this just started a few weeks ago. It seems very intermittent, but then this weekend, almost like clockwork.

2 2

netmask
by Antonio Brown 15 Dec '05

15 Dec '05

Hello All, I was wondering which of the two formats below would you use when filtering using syslog-ng: filter f_pix { match(PIX) and not match(" 1.2.3.4|1.2.3.4|1.2.3.4|1.2.3.4|netmask(" 1.2.3.4/28")|netmask("1.2.3.4/20")|netmask("1.2.3.4/22")|netmask("1.2.3.4/28") ") }; or...... filter f_pix { match(PIX) and not match(1.2.3.4) and not match(1.2.3.4) and not match(1.2.3.4) and not match(1.2.3.4) and not match(netmask("1.2.3.4/28")) and not match(netmask("1.2.3.4/20")) and not match(netmask("1.2.3.4/22")) and not match(netmask("1.2.3.4/28")) }; I am currently using the latter, but it seems as if the individual ips and subnets would only be filtered if ALL is true. Would using "|", like in the first format, check for each individual ip or subnet and filter accordingly? When I say filter I mean, I would like everything except for the individual IPs and subnets specified. I am not certain that this is appropriate format for filtering subnets, please advise.... Thank You, in advance for your assistance!!!

2 2

Re:[syslog-ng] netmask
by Fred Turner 14 Dec '05

14 Dec '05

I will be away from the office from Dec 14, 2005 and will return to the office on Dec 15, 2005. Please call 905-426-4229 (BBi's IT Support Line) for any System related Issues. If you have any urgent issue that needs my attention please contact me on my cell phone. Thank you. ================================================================== NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.

1 0