- syslog-ng - lists.balabit.hu

Unix-stream destination as listen socket
by Peter Nahas 20 Oct '05

20 Oct '05

Hello everyone, I am currently working on a project using syslog-ng-1.9.5 (soon to upgrade to 1.9.6) which requires a syslog-ng destination to be a Unix socket. The problem is that the syslog-ng daemon will always be started before the destination application. So to prevent the loss of messages due to the reconnect timer, the syslog-ng destination Unix socket will have to listen()/accept() for a connection rather than connect() to an external socket. If this enhancement would be used by others, I would like to write this properly. Therefore I have the following questions: A) If this enhancement were written, would it be accepted into the repository? If not, I will simply hack up the current AFUnixDestinationDriver to do what I want. B) Is there any specification document which would assist me in making this enhancement? C) Would this best be done by adding an additional option to unix-stream for destinations or by creating a separate destination driver? D) It appears as if the AFSocketDestinationDriver is not designed to perform listen()/accept(), but the AFSocketSourceDriver is. Would it be possible to set up the AFUnixDestinationDriver to use the AFSocketSourceDriver as a parent, but attach it to a log writer? Thanks in advance, Peter Nahas Software Engineer MRV Communications - InReach division

3 4

Filter based on source?
by Robert.Becker＠motoristsgroup.com 20 Oct '05

20 Oct '05

As with many people I am using syslog-ng to send all my logs to a central source. A bunch of the logs I am sending are from growing log files. I have everything working and quite well, but I have one problem. When syslog-ng builts the log statement it goes in the following format: Oct 20 09:59:24 server_pipe@linuxp17 [org.jboss.resource.connectionmanager.IdleRemover] run: IdleRemover notifying pools, interval: 450000 server_pipe is the name of the source, defined on the client syslog server, this log is coming from. When this log is piped via tcp to the central server I want to be able to filter the server_pipe part and send it to a specific destination. Can this be done? From what I've read the match only works on the message section. I need to filter based the source. Any ideas? Thanks a bunch. -Rob Becker ********************************************************************** The information contained in this message is confidential and is intended for the addressee(s) only. If you have received this message in error or there are any problems please notify the originator immediately. The unauthorized use, disclosure, copying or alteration of this message is strictly forbidden. Motorists Insurance Group will not be liable for direct, special, indirect or consequential damages arising from the alteration of the contents of this message by a third party or as a result of any virus being passed on. **********************************************************************

2 1

Problem with setup of syslog-ng loghost in HA environment
by Berthold Cogel 19 Oct '05

19 Oct '05

Hello! We want to set up a syslog-ng in a HA Cluster (Red Hat Clumanager). The Cluster has two nodes for failover of services with attached shared storage from our SAN. The idea was to use syslog-ng only for the loghost. Local logging on all machines is done by standard syslog and forwarded to the loghost. The loghost uses his own IP which is handed over from one node to the other in case of a failover situation. It is not a problem to get the loghost running. The problem is the logging on the cluster node that is the current loghost. Although syslog doesn't log remote messages and syslog-ng binds to another (virtual) interface. We have an old loghost with syslog, where our systems send parts of their messages. This works, even for the system, syslog-ng is running on. I can see the udp packets with ethereal. But there is no syslog traffic to the second IP or localhost. Only 'external' messages get logged with syslog-ng The system is Red Hat Enterprise Linux 3. syslog-ng is 1.6.8. Thanks in advance Berthold Cogel

2 1

syslog server
by John.Dickinson＠nominet.org.uk 19 Oct '05

19 Oct '05

I have a central syslog server receiving log messages from clients. I want to store the messages on the clients and the server (with different rotation/archiving setting). From what I have seen I will need to have all the syslog configuration on both the client and the server. Is there anyway to simplify this? As an example: I have something like this on the client (along with other filters and destinations) filter f_emerg { level (emerg); }; filter f_alert { level (alert .. emerg); }; filter f_crit { level (crit .. emerg); }; filter f_err { level (err .. emerg); }; filter f_warning { level (warning .. emerg); }; filter f_notice { level (notice .. emerg); }; filter f_info { level (info .. emerg); }; filter f_debug { level (debug .. emerg); }; filter f_kern { facility (kern); }; filter f_user { facility (user); }; filter f_mail { facility (mail); }; filter f_daemon { facility (daemon); }; filter f_auth { facility (auth); }; filter f_syslog { facility (syslog); }; filter f_lpr { facility (lpr); }; filter f_news { facility (news); }; filter f_uucp { facility (uucp); }; filter f_cron { facility (cron); }; filter f_local0 { facility (local0); }; filter f_local1 { facility (local1); }; filter f_local2 { facility (local2); }; filter f_local3 { facility (local3); }; filter f_local4 { facility (local4); }; filter f_local5 { facility (local5); }; filter f_local6 { facility (local6); }; filter f_local7 { facility (local7); }; filter f_kern_debug { filter (f_kern) and filter (f_debug); }; filter f_daemon_notice { filter (f_daemon) and filter (f_notice); }; filter f_mail_crit { filter (f_mail) and filter (f_crit); }; filter f_syslog { filter (f_err) or filter (f_kern_debug) or filter (f_daemon_notice) or filter (f_mail_crit); }; destination d_syslog { file ("/var/log/syslog"); }; destination d_log_server { tcp ("127.0.0.1" port (514) tcp-keep-alive(yes) log_fifo_size(10000)); }; log { source (s_local); filter (f_syslog); destination (d_syslog); }; log { source (s_local); filter (f_syslog); destination (d_log_server); }; On the server I want to get all the messages in a file with the same name as they are in on the client. Do I have to repeat all these filters again on the server or is there a way to find what log statement they matched on the client? Basically, I dont want to be repeating the config everywhere because it will become a maintenance nightmare. John

1 0

clustering syslog-ng
by John.Dickinson＠nominet.org.uk 19 Oct '05

19 Oct '05

Hi, I am trying to setup a clustered syslog server using polyserve, syslog-ng (1.6.8) and stunnel. Log messages are sent using TCP for reliability. I am testing the setup by generating 10 messages per second on a client. The messages are numbered so that I can see if any are missing. Logging is working but when I force the syslog service to fail over to a different node in the cluster I lose messages. From what I have read on these lists I would expect syslog-ng 1.6.8 to lose one message when it finds that the first server has failed but should queue the rest until the service returns on the other node. However I am losing around 200 messages. This part of the client config destination d_log_server { tcp ("127.0.0.1" port (514) tcp-keep-alive(yes) log_fifo_size(10000)); }; log { source (s_local); filter (f_local7_info); destination (d_log_server); }; and the server options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_ext { tcp(ip(127.0.0.1) port(514) tcp-keep-alive(yes)); }; destination d_dev1 { file("/logs/dev1.log"); }; log { source(s_ext); destination(d_dev1); }; This stunnel config is the same as the example on the stunnel web site. Any ideas? I know it is only beta but would I be better off using syslog-ng 1.9? I realise that I could do this without the clustering and just send all the messages to both servers but this way I have no duplication of logs. Thanks John

1 0

Syslog-ng.conf syntax
by SOLIS, ALEX 19 Oct '05

19 Oct '05

Does a log statement need to all be on one line? I have a log statement with two sources, 4 filters and 2 destinations. It all wont fit on one line. When I try to break it up into a block format logging stops for those destiniations. I am sure I am missing something. Here is the log statement: log { source(net); source(net_tcp); filter (f_not_nmrouter); filter (f_not_non_critical_windows); filter (f_not_non_crit_unix); filter (f_not_uiz_servers); destination(x); destination(y); }; Is this broken up correctly? <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

3 2

messed up permissions on /dev/null destination on solaris
by Nate Campi 18 Oct '05

18 Oct '05

When using /dev/null as a destination on Solaris 8 (sparc) with syslog-ng 1.6.7 the perms of /dev/null get messed up: $ ls -l /dev/null lrwxrwxrwx 1 root other 27 Apr 19 2003 /dev/null -> ../devices/pseudo/mm@0:null $ ls -l /devices/pseudo/mm@0:null crw-r--r-- 1 root root 13, 2 Oct 16 18:27 /devices/pseudo/mm@0:null I thought this was addressed at some point, was that only on Linux perhaps? Thanks, -- Nate "Hardware : The parts of a computer system that can be kicked." - Pesis, Jeff

5 10

program dies
by Jeff DiNisco 18 Oct '05

18 Oct '05

I'm running syslog-ng on solaris 10. I have a destination defined as - destination d_alert { program("/usr/local/admin/syslog-ng/alert.bash"); }; when syslog-ng is started, these processes also start... /bin/bash /usr/local/admin/syslog-ng/alert.bash /bin/sh -c /usr/local/admin/syslog-ng/alert.bash About an hour later, for no apparent reason, the 2 alert.bash processes die but the syslog-ng process continues to run. I've implemented a watchdog script to alert and restart syslog-ng when they die. It's interesting to note that they seem to die exactly 1 hour after being restarted. command used to start syslog-ng - /usr/local/sbin/syslog-ng -f /usr/local/etc/syslog-ng.conf >> ${logfile} 2>&1 alert.bash script... #!/bin/bash export mailaddr=jeff(a)xxxxxx.com while read input do hostname=`echo ${input} |awk '{print $4}' |sed 's|/.*||'` program=`echo ${input} |awk '{print $5}' |sed 's|[[(].*||'` echo ${input} | mailx -s "${program} alert on ${hostname}" ${mailaddr} done Any help would be greatly appreciated. - Jeff __________________________________ Yahoo! Music Unlimited Access over 1 million songs. Try it free. http://music.yahoo.com/unlimited/

3 3

How does regex work with HOST definitions?
by Jason Haar 17 Oct '05

17 Oct '05

Hi there I have a subset of syslog-ng hosts that use a specific DNS formatted naming convention that I wish to ensure all their data is caught by a particular syslog-ng filter. I have filter f_process_Test { host("^...\-..\-ids\-[0-9]+\...\.our\.net$") and not host("abc-xy-ids-02\.our\.net"); }; i.e. I want abc-12-ids-01.aa.our.net and xyz-12-ids-01.aa.our.net to be caught by this filter, but abc-xy-ids-02\.our\.net not to be. I could explicitly name them all I suppose - but there are 12+ of them and they are growing in number. A regex would be much more efficient. Anyway, it doesn't work. That filter never triggers. I know the hostnames are correct as I have a general catch-all rule that logs to filenames containing the hostname - and those hostnames show up in there. Can anyone explain what I've got wrong? REGEX works fine in my "match" calls... This is syslog-ng-1.6.7-2 under CentOS4.1 Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

6 9

messages on syslog-ng server and locals files
by Atif Munir 17 Oct '05

17 Oct '05

Hi All, How can I have messages on the remote syslog-ng server and on local files? Thanks in advance. Atif

1 0