- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Syslog-ng configuration.
by Adams, Russell L. 06 Oct '05

06 Oct '05

See the syslog-ng FAQ on campin.net, and also: http://www.adamsinfoserv.com/central_syslog.pdf Russell On Fri, Oct 07, 2005 at 12:28:47AM +0530, Krishnakumar Menon wrote: > > > > > Hi , > > I am new to this group. Just recently felt a need to centralize all my > /var/adm/messages for my 12 different machines. > > The job is I have 12 Solaris machines. > > I want to make one server as central syslog server. The rest 12 servers > will send their messages file to this central syslog server where the > activities will be logged. > > Few queries. > > a. How will syslog-ng will help me to achieve this? > b. Which is the latest software and patch to be downloaded ? > c. What activities i.e. installation/configuration needs to be done > at Server side and client side ? > d. How to monitor and administer these files. i.e. is their any > GUI's or CLI's in place ? > > > > Thanks and regards > > Krishna > > > > > > **************** CAUTION - Disclaimer ***************** > This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended > solely for the use of the addressee(s). If you are not the intended > recipient, please notify the sender by e-mail and delete the original > message. Further, you are not to copy, disclose, or distribute this > e-mail or its contents to any other person and any such actions are > unlawful. This e-mail may contain viruses. Infosys has taken every > reasonable precaution to minimize this risk, but is not liable for any > damage you may sustain as a result of any virus in this e-mail. You > should carry out your own virus checks before opening the e-mail or > attachment. Infosys reserves the right to monitor and review the content > of all messages sent to or from this e-mail address. Messages sent to or > from this e-mail address may be stored on the Infosys e-mail system. > ***INFOSYS******** End of Disclaimer ********INFOSYS*** > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >

1 0

Syslog-ng configuration.
by Krishnakumar Menon 06 Oct '05

06 Oct '05

Hi , I am new to this group. Just recently felt a need to centralize all my /var/adm/messages for my 12 different machines. The job is I have 12 Solaris machines. I want to make one server as central syslog server. The rest 12 servers will send their messages file to this central syslog server where the activities will be logged. Few queries. a. How will syslog-ng will help me to achieve this? b. Which is the latest software and patch to be downloaded ? c. What activities i.e. installation/configuration needs to be done at Server side and client side ? d. How to monitor and administer these files. i.e. is their any GUI's or CLI's in place ? Thanks and regards Krishna **************** CAUTION - Disclaimer ***************** This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message. Further, you are not to copy, disclose, or distribute this e-mail or its contents to any other person and any such actions are unlawful. This e-mail may contain viruses. Infosys has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Infosys reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infosys e-mail system. ***INFOSYS******** End of Disclaimer ********INFOSYS***

1 0

syslog-ng on AIX 5.3
by Michael Mannsberger 06 Oct '05

06 Oct '05

Does not log at all. Anybody got this working on AIX?

2 1

RE: [syslog-ng] Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 06 Oct '05

06 Oct '05

> I've added a simple configure check on tm_gmtoff and if it does not > exist I fall back to the global "timezone" variable. > > It should be available in the yesterday's snapshot. > > -- > Bazsi THANKS so much. Really appreciated!

1 0

RE: [syslog-ng] Centralize different kind of logs ...
by Marvin.Nipper＠Stream.com 06 Oct '05

06 Oct '05

> -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > CIKALA Frederic ROSI/DOSI > Sent: Thursday, October 06, 2005 2:27 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Centralize different kind of logs ... > > Hello, i haven't received my second mail for this ML, so i re send it > > I'm wondering if i'll use syslog-ng in order to centralize a > lot of logs that are from different kind of machines. > > Actually i've to centralize logs that are from Active > Directory, Exchange .... > > For example, those others machines have UNIX, Solaris, > Windows and VMS for OS ... > > In fact, i don't know if it exists a tool that can do this > thing for my several servers ... > > Thanks for help :) Take a look at SNARE. You can find it here: http://www.intersectalliance.com/projects/index.html It's a good way to get Windows Event Logs fed upstream to syslog-ng.

1 0

patch for $PID support
by Jason Pepas 06 Oct '05

06 Oct '05

Hurray for insomnia! I have implemented $PID macro support in syslog-ng 1.6.8, and have tested it out on gentoo linux. http://www.ices.utexas.edu/~cell/gentoo/syslog-ng/ -jason pepas

2 1

Centralize different kind of logs ...
by CIKALA Frederic ROSI/DOSI 06 Oct '05

06 Oct '05

Hello, i haven't received my second mail for this ML, so i re send it I'm wondering if i'll use syslog-ng in order to centralize a lot of logs that are from different kind of machines. Actually i've to centralize logs that are from Active Directory, Exchange .... For example, those others machines have UNIX, Solaris, Windows and VMS for OS ... In fact, i don't know if it exists a tool that can do this thing for my several servers ... Thanks for help :) *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

1 0

syslog-ng sending to pipe
by shaun.hofer＠altcall.com 06 Oct '05

06 Oct '05

Hi all Syslog-ng is set to write to a pipe. Syslog-ng starts very early on in the boot process, nothing is reading from the pipe yet. Later on, mysql script starts reading from the pipe, but by that time, it seems as though syslog isn't bothering to write to the pipe anymore. 'ps axf' shows this for the mysql init script: '2023 /etc/init.d/sqlsyslogd start' The mysql init script thinks the pipe is blocked. If you restart syslog-ng at this point the mysql script starts reading from the pipe. Do you have any ideas as to how to get this working? Heres the script: case "$1" in start) # If the pipe does not exist, create it if [ ! -e /tmp/mysql.pipe ] ; then mkfifo /tmp/mysql.pipe fi mysql -u sys --password=xxxx syslog< /tmp/mysql.pipe & ;; stop ) if [ -e /tmp/mysql.pipe ]; then rm -f /tmp/mysql.pipe fi ;; *) echo "Usage: sqlsyslogd {start|stop}" exit 1; esac exit 0; >From the syslog-ng.conf: destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG','$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") templ ate-escape(yes)); }; log { source(s_all); source(tcpgateway); destination(d_mysql); }; Thanks in advance Shaun

2 3

no $PID macro?
by Jason Pepas 05 Oct '05

05 Oct '05

Hi, The log format macro system is a great idea. However, I didn't see $PID as an option. Is there a reason for this? Should I wade through the source and create a patch, or is this an unsolveable problem? thanks, jason pepas

3 4

RE: [syslog-ng] Architecture Question'
by CIKALA Frederic ROSI/DOSI 05 Oct '05

05 Oct '05

Yes, i know it is not specific enough ... But nobody here can tell me exactly the frequency of the logs that will be sent :-/ One thing is sure : it wont be 1 message per server per day, but something like 500 /server /days ... Do you want to know something else ? -----Message d'origine----- De : syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu]De la part de kenneth.gullberg(a)foreningssparbanken.se Envoyé : mardi 4 octobre 2005 10:00 À : syslog-ng(a)lists.balabit.hu Objet : SV: [syslog-ng] Architecture Question' im afraid that the only answer you are going to get is: Depends on what kind of traffic you expect to be seeing.. 7000 machines logging 1 message every minute is nothing but if you are expected to receive 1 message / second / server then you need a different setup.. You need to be more specific! -----Ursprungligt meddelande----- Från: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] För CIKALA Frederic ROSI/DOSI Skickat: den 4 oktober 2005 09:34 Till: syslog-ng(a)lists.balabit.hu Ämne: [syslog-ng] Architecture Question' Hello everyone' I'm new to this mailing list and i do not know syslogNG yet Actually, i have to prepare a server that will centralize a lot of logs, from about 7000 other servers. I've read that syslogNG is a great tool that can do a lot of interresting things. Therefore, i chose this application for my project but i do not know if it needs big ressources to be launched ... In fact, i'm wondering about the hardware i'll have to buy in order to make this project Maybe someone of this list has got a greater opinion about what i'll have to buy for example "at least a 3gHz cpu, with 2 gig of ram ..." It could be usefull', thank you ^^ *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. *********************************** *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

3 2