- syslog-ng - lists.balabit.hu

Changing replacing $Host characters
by Chance Ellis 29 Sep '05

29 Sep '05

A large number of my log messages come in and the $HOST variable is an IP address. I am creating a mysql table for each unique host. The problem is, mysql does not allow table names with periods in them, or at least I can't figure out how to make it. Is there a way in the syslog-ng.conf file that I can use regexp to change 10.1.1.1 <http://10.1.1.1> to 10_1_1_1 for example? Or does anyone happen to know how to make mysql accept `10.1.1.1` as a valid table name? Thanks!

1 0

RE: [syslog-ng] Syslog 1.6.8 compile error
by William Bell 27 Sep '05

27 Sep '05

I have seen this before with bad version of byacc/flex/lex you might want to install a new version of each, link your new libraries and try again. William -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Rohald van Baars Sent: Tuesday, September 27, 2005 7:30 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Syslog 1.6.8 compile error Hi, can someone please help me to get the compile right. OS: RHEL ES 3 update 4 The ./configure went well no errrors. But the make did not go so well: Error message(s) : >> snip gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afpr gram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lnsl -lresolv / sr/local/lib/libol.a -lnsl -Wl,-Bstatic -Wl,-Bdynamic cfg-lex.o(.text+0x45f): In function `yylex': /root/rpm/syslog-ng/syslog-ng-1.6.8/src/cfg-lex.c:1123: undefined reference to yywrap' cfg-lex.o(.text+0xb33): In function `input': /root/rpm/syslog-ng/syslog-ng-1.6.8/src/cfg-lex.c:1450: undefined reference to yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make: *** [all-recursive] Error 1 << snap Can someone plz explain what went wrong? Rohald van Baars Digitenne B.V. The netherlands WWW: www.digitenne.nl ######################################################################## #### Attention: The information contained in this message and or attachments is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any system and destroy all copies. ######################################################################## #### _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng 1.6.8 and dns cache issue
by Ketan Vankawala 22 Sep '05

22 Sep '05

I have currently installed Syslog-ng ver 1.6.8. Here is a snippet of my syslog-ng config file: destination hostslocal { file("/var/log/HOSTS/$HOST/$YEAR-$MONTH-$DAY.log" owner(root) group(xxx) perm(0740) dir_perm(0740) create_dirs(yes) template("$R_DATE $FULLHOST $MONTH $S_DAY $S_YEAR $S_HOUR:$S_MIN:$S_SEC: $MESSAGE\n") template-escape(no)); }; log { source(src); destination(hostslocal); }; So accordingly when a syslog message comes in, depending on the ip address, it does a lookup in /etc/hosts, creates an appropriate host name folder and forwards the message there. If the hostname does not exists, it creates a folder named with the ip address. Here is my question: 1) How often does syslog-ng refreshes its dns /hosts cache? Because I have run into issues that even after the /etc/hosts file is updated syslog still keeps logging to the folder created with the ip address. If I restart syslog-ng service it immediately starts forwarding the messages correctly to hostname folder. 2) How can I reduce the dns cache timeout, so it checks /etc/hosts more frequently for any changes? Any help will be highly appreciated. thx. Ketan

1 0

encrypt syslog-ng messages
by shaun.hofer＠altcall.com 21 Sep '05

21 Sep '05

I've setup syslog-ng on a log server and it's successfully receiving log messages from various clients. I want to encrypt the messages, so I used SSH tunnels and stunnel. However, in both of those cases, syslog-ng sees the message as having originated from itself, rather than from the real sender. Is there a way to fix this, or is there a different way to encrypt the messages? Thanks for your help, syslog-ng's awesome. -Shaun

2 1

I have a question
by 赵武 21 Sep '05

21 Sep '05

I am a chinese, my english is not good . ^_^ I used syslog-ng_1.6.x , there has a startup script (maybe init.d.RedHat-7.3 )in install directory . So I can start or stop it very easy . But in syslog-ng_1.9.5 , I haven't found the startup script , there is not convenience. I used logrotate.d separate log files . when the logrotate.d finished , it will restart the syslog-ng service . if there haven't startup script , I must added a script in logrotate.conf : postrotate /usr/bin/killall -HUP /usr/local/syslog-ng/sbin/syslog-ng 2> /dev/null || true endscript above script always killed the syslog-ng process and not startup syslog-ng process .I don't know the reason. when i used syslog-ng_1.6.x , I can use a easy script instead of above script : postrotate service syslog-ng restart endscript that is ok ! Could you give me a suggestion ! thanks . john 　　　　　　　　john.zw(a)263.net 　　　　　　　　　　2005-09-20

3 3

RE: [syslog-ng] encrypt syslog-ng messages
by Clemson, Chris 21 Sep '05

21 Sep '05

syslog-ng: http://www.balabit.com/products/syslog_ng/reference-1.6/syslog-ng.html/x 768.html I use it as follows: options { keep_hostname(yes); long_hostnames(off); sync(0); }; > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > shaun.hofer(a)altcall.com > Sent: 21 September 2005 10:39 > To: Syslog-ng users' and developers' mailing list > Subject: RE: [syslog-ng] encrypt syslog-ng messages > > In which program has this option? stunnel4? > > Thanks > Shaun > > Would the "keep_hostname" option help? > > > >> -----Original Message----- > >> From: syslog-ng-bounces(a)lists.balabit.hu > >> [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > >> shaun.hofer(a)altcall.com > >> Sent: 21 September 2005 09:53 > >> To: syslog-ng(a)lists.balabit.hu > >> Subject: [syslog-ng] encrypt syslog-ng messages > >> > >> I've setup syslog-ng on a log server and it's successfully > >> receiving log > >> messages from various clients. I want to encrypt the > >> messages, so I used > >> SSH tunnels and stunnel. However, in both of those cases, > >> syslog-ng sees > >> the message as having originated from itself, rather than > >> from the real > >> sender. Is there a way to fix this, or is there a different > >> way to encrypt > >> the messages? > >> > >> Thanks for your help, syslog-ng's awesome. > >> -Shaun > >> > >> _______________________________________________ > >> syslog-ng maillist - syslog-ng(a)lists.balabit.hu > >> https://lists.balabit.hu/mailman/listinfo/syslog-ng > >> Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > >> > >> > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

1 0

RE: [syslog-ng] encrypt syslog-ng messages
by Clemson, Chris 21 Sep '05

21 Sep '05

Would the "keep_hostname" option help? > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > shaun.hofer(a)altcall.com > Sent: 21 September 2005 09:53 > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] encrypt syslog-ng messages > > I've setup syslog-ng on a log server and it's successfully > receiving log > messages from various clients. I want to encrypt the > messages, so I used > SSH tunnels and stunnel. However, in both of those cases, > syslog-ng sees > the message as having originated from itself, rather than > from the real > sender. Is there a way to fix this, or is there a different > way to encrypt > the messages? > > Thanks for your help, syslog-ng's awesome. > -Shaun > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

2 1

Re: [syslog-ng] freebsd syslog-ng error
by fico gid 21 Sep '05

21 Sep '05

Hi William/All, Is the configuration below enough for me to log some of my routers ? 157.0.1.1 is my syslog server and im getting logs frm a few routers. I have added appropriate logging commands on the routers to log to the syslog server. --start-- ## syslog-ng source remote { unix-stream("/var/run/log"); internal(); pipe("/dev/klog"); udp(ip(157.0.1.1) port(514)); tcp(ip(157.0.1.1) port(514) keep-alive(yes)); }; destination std { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; log { source(remote); destination(std); }; --end-- Your help is much appreciated. fico On 9/21/05, fico gid <ficohertz(a)gmail.com> wrote: > Hi William, > > Thanks a lot for the tips.. its working now. > > Fico. > > On 9/20/05, William Bell <williamb(a)cwie.net> wrote: > > The problem you are having is in attempting to use linux conventions in > > freebsd. You will need to use /var/run/log in place of /dev/log and > > instead of /proc/kmsg you will most likely have to use > > > > file("/dev/klog"); > > > > Changing these two will get you the results you need. > > > > -William B > > > > -----Original Message----- > > From: syslog-ng-bounces(a)lists.balabit.hu > > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of fico gid > > Sent: Tuesday, September 20, 2005 2:10 AM > > To: syslog-ng(a)lists.balabit.hu > > Subject: [syslog-ng] freebsd syslog-ng error > > > > Hi there, > > > > im trying to setup a syslogng server to collect logs from a few of my > > routers. I have installed syslogng and modified the script as below : > > > > --start-- > > ## syslog-ng > > > > > > source remote { > > unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); > > udp(ip(158.0.1.1) port(514)); > > tcp(ip(158.0.1.1) port(514) keep-alive(yes)); > > }; > > > > destination std { > > file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" > > owner(root) group(root) > > perm(0644) dir_perm(0755) create_dirs(yes)); > > }; > > > > log { > > source(remote); > > destination(std); > > }; > > > > destination authlog { file("/var/log/auth.log"); }; > > destination cron { file("/var/log/cron.log"); }; > > destination debug { file("/var/log/debug.log"); }; > > destination kern { file("/var/log/kern.log"); }; > > destination user { file("/var/log/userlog"); }; > > > > --end-- > > > > somehow when i start the syslog-ng , it doesnt work and gives the error > > below : > > > > io.c: bind_unix_socket(): bind failed /dev/log (Operation not supported) > > Error initializing configuration, exiting. > > > > The syslog-ng by default config works fine. > > > > What am i doing wrong here ? > > > > fico > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > >

1 0

Re: Re: [syslog-ng] I have a question
by 赵武 21 Sep '05

21 Sep '05

Roberto Nibali,您好！ I am glad to receive your reply . Thank you very much . I am so surprised that you know the chinese idiom " 滴水穿石 di shui chuan shi ". Are you a chinese ? hehe ======= 2005-09-20 16:36:21 您在来信中写道：======= >Dear John, > >> I used syslog-ng_1.6.x , there has a startup script (maybe init.d.RedHat-7.3 ) >> in install directory . So I can start or stop it very easy . But in syslog-ng_1.9.5 , >> I haven't found the startup script , there is not convenience. I used logrotate.d >> separate log files . when the logrotate.d finished , it will restart the syslog-ng >> service . if there haven't startup script , I must added a script in logrotate.conf : > >Why not use the syslog-ng-1.6.x startup script? > >> postrotate >> /usr/bin/killall -HUP /usr/local/syslog-ng/sbin/syslog-ng 2> /dev/null || true >> endscript >> >> above script always killed the syslog-ng process and not startup syslog-ng process .I don't know the reason. > >This indeed is a bit strange as -HUP should not kill the process per se >with regard to syslog-ng. I've just tested this and and if I do it by >hand the syslog-ng process is indeed killed by this, although not all >the time. Some short time digging reveiled following: > >webphish:~ # ulimit -c unlimited >webphish:~ # /sbin/syslog-ng-1.9.5 -v -d -d -F > >[in another terminal send a /usr/bin/killall -HUP /sbin/syslog-ng-1.9.5] > >Segmentation fault (core dumped) >webphish:~ # gdb -q /sbin/syslog-ng-1.9.5 ./core >Using host libthread_db library "/lib/tls/libthread_db.so.1". >Core was generated by `/sbin/syslog-ng-1.9.5 -v -d -d -F'. >Program terminated with signal 11, Segmentation fault. >#0 0x08065009 in g_string_truncate () >(gdb) bt >#0 0x08065009 in g_string_truncate () >#1 0x08065fbc in g_string_assign () >#2 0x0804f85e in log_source_group_queue (s=0x8116988, msg=0x810e290, > path_flags=0) at sgroup.c:110 >#3 0x0804a878 in log_pipe_forward_msg (self=0x0, msg=0x81113d8, >path_flags=0) > at logpipe.h:72 >#4 0x080533ea in log_source_queue (s=0x8116540, msg=0x81113d8, >path_flags=0) > at logpipe.h:72 >#5 0x08052dc3 in afinter_source_dispatch_msg (pipe=0x0, msg=0x81113d8) > at logpipe.h:72 >#6 0x08052df3 in afinter_source_dispatch (source=0x8116568, > callback=0x8052db0 <afinter_source_dispatch_msg>, user_data=0x8116540) > at afinter.c:51 >#7 0x08058ef8 in g_main_context_dispatch () >#8 0x0805b0e7 in g_main_context_iterate () >#9 0x0805b1ba in g_main_context_iteration () >#10 0x0804854f in main_loop_run (cfg=0x81163c0) at main.c:142 >#11 0x0804882a in main (argc=5, argv=0xbffff344) at main.c:387 >(gdb) q >webphish:~ # > >No time to further dig into this yet. > >> when i used syslog-ng_1.6.x , I can use a easy script instead of above script : >> >> postrotate >> service syslog-ng restart >> endscript > >Check out the contrib directory of the syslog-ng-1.6.x source tree and >there you'll find all the startup scripts needed. They should also work >for the 1.9.x drop of syslog-ng. > >Bazsi, do you think that copying the contrib directory from 1.6.x to >1.9.x would make sense? > >> Could you give me a suggestion ! thanks . > >Di shui chuan shi ;) and best regards, >Roberto Nibali, ratz >-- >echo >'[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > = = = = = = = = = = = = = = = = = = = = 　　　　　　　　致礼！　　　　　　　　赵武　　　　　　　　john.zw(a)263.net 　　　　　　　　　　2005-09-21

1 0

syslog-ng wont start on fresh gentoo
by Venkata Phani Kiran Achanta 21 Sep '05

21 Sep '05

What am I missing? Linux ematest 2.6.12-gentoo-r10 #1 SMP Thu Sep 15 14:07:53 GMT 2005 i686 Intel(R) Pentium(R) 4 CPU 2.80GHz GenuineIntel GNU/Linux /etc/init.d/syslog-ng start * Starting syslog-ng ... Error initializing configuration, exiting. ematest ~ # cat strace.info execve("/usr/sbin/syslog-ng", ["syslog-ng"], [/* 29 vars */]) = 0 uname({sys="Linux", node="ematest", ...}) = 0 brk(0) = 0x8064000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=18434, ...}) = 0 mmap2(NULL, 18434, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7f24000 close(3) = 0 open("/lib/libnsl.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0 5\0\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=76468, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f23000 mmap2(NULL, 83968, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f0e000 mmap2(0xb7f1f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x10) = 0xb7f1f000 mmap2(0xb7f21000, 6144, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f21000 close(3) = 0 open("/lib/libresolv.so.2", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\0&\0\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=69324, ...}) = 0 mmap2(NULL, 80148, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7efa000 mprotect(0xb7f09000, 18708, PROT_NONE) = 0 mmap2(0xb7f0a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xf) = 0xb7f0a000 mmap2(0xb7f0c000, 6420, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f0c000 close(3) = 0 open("/lib/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\360V\1"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1227872, ...}) = 0 mmap2(NULL, 1142148, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7de3000 mmap2(0xb7ef4000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x110) = 0xb7ef4000 mmap2(0xb7ef8000, 7556, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7ef8000 close(3) = 0 mprotect(0xb7ef4000, 4096, PROT_READ) = 0 munmap(0xb7f24000, 18434) = 0 open("/dev/urandom", O_RDONLY) = 3 read(3, "\237\317\242\334", 4) = 4 close(3) = 0 brk(0) = 0x8064000 brk(0x8085000) = 0x8085000 open("/etc/localtime", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=56, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f28000 read(3, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0"..., 4096) = 56 close(3) = 0 munmap(0xb7f28000, 4096) = 0 open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) = 3 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbf93cc4c) = -1 ENOTTY (Inappropriate ioctl for device) fstat64(3, {st_mode=S_IFREG|0644, st_size=1066, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f28000 read(3, "# $Header: /var/cvsroot/gentoo-x"..., 8192) = 1066 read(3, "", 4096) = 0 read(3, "", 8192) = 0 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbf93c6ec) = -1 ENOTTY (Inappropriate ioctl for device) close(3) = 0 munmap(0xb7f28000, 4096) = 0 pipe([3, 4]) = 0 fork() = 11240 close(4) = 0 read(3, "\1", 1) = 1 exit_group(1) = ?

2 1