- syslog-ng - lists.balabit.hu

Re: [syslog-ng] expanding $HOST in 1.6.*
by t_esting＠excite.com 08 Sep '05

08 Sep '05

>> Hello, syslog-ng gurus. I have been trying unsuccessfully to replicate syslog-ng 1.5.26 behavior over to the current stable release. Specifically, here's what I can't seem to get to work from my config: >> >> destination d_ipfilters_bymin { file ("/var/logser/$HOST/$YEAR/$MONTH/$DAY/ipfilters.log.$HOUR.$MIN" >> owner(root) perm(0600) create_dirs(yes) ); }; >> >> filter f_fwsm_misc { >> match(" \%FWSM-") and >> match(": (Teardown|Translation|Built)"); >> }; >> >> log { source(s_udp); filter(f_fwsm_misc); destination(d_ipfilters_bymin); }; >> >> With syslog-ng 1.5.26 (linked against libol 0.3.10 on Solaris 8 using GCC in 64-bit mode), this config writes my FWSM messages to /var/logser correctly. I have been unable to do the same using either 1.6.8; the messages just fall through to my catchall destination. >> >> Can anyone offer some advice on how to reproduce the 1.5.x $HOST expansion behavior in 1.6.x? >I can't really understand. Do you have a problem with matching the log lines or the filename where the line is written to? I was having trouble with the filename matching. I've seen a couple of different behaviors in the 1.6.x release. At different times, I've seen $HOST expanded as the DNS name, other times as the IP address. Other times, I've seen it drop all the way through to catchall (though I'm not able to recreate that this morning with 1.6.8 for some reason). I'll continue to do testing over the next couple of days to see if I can articulate exactly what I'm seeing with a larger scope of test data. Thanks. T.E. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

1 0

expanding $HOST in 1.6.*
by t_esting＠excite.com 08 Sep '05

08 Sep '05

Hello, syslog-ng gurus. I have been trying unsuccessfully to replicate syslog-ng 1.5.26 behavior over to the current stable release. Specifically, here's what I can't seem to get to work from my config: destination d_ipfilters_bymin { file ("/var/logser/$HOST/$YEAR/$MONTH/$DAY/ipfilters.log.$HOUR.$MIN" owner(root) perm(0600) create_dirs(yes) ); }; filter f_fwsm_misc { match(" \%FWSM-") and match(": (Teardown|Translation|Built)"); }; log { source(s_udp); filter(f_fwsm_misc); destination(d_ipfilters_bymin); }; With syslog-ng 1.5.26 (linked against libol 0.3.10 on Solaris 8 using GCC in 64-bit mode), this config writes my FWSM messages to /var/logser correctly. I have been unable to do the same using either 1.6.8; the messages just fall through to my catchall destination. Can anyone offer some advice on how to reproduce the 1.5.x $HOST expansion behavior in 1.6.x? Thanks in advance. T.E. _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1

Cisco boxes and syslog-ng
by Joost greene 07 Sep '05

07 Sep '05

Hello, I have different sets of devices, dslams, nas, core routers, customer routers,... i want to syslog them all, i want to make each device log to a file separately to ease it up for NOC, someone suggested syslog-ng, frankly, i got quickly lost in its docs, the syntax isnt clear, how can i just easily specify to let it log per source into different files ? Regards, Joost

2 1

RE : How do I force syslog-ng to create an empty log file ??
by Eggart, Gerhard 07 Sep '05

07 Sep '05

Hi, We are currently using syslog-ng (syslog-ng 1.6.0rc4) to log for local log messages on a device. We have the following in the config file to store local auth messages. destination local_auth { file("/var/log/local/auth.$YEAR$MONTH$DAY"); }; We have the following in the config file to store local error messages. destination local_err { file("/var/log/local/errors.$YEAR$MONTH$DAY"); }; The problem I have is that sometimes for a day there are no error or auth messages and because of this the log file is not generated, a log file is only created if there is log data to put into it. I require syslog-ng to force the creation of a log file for the day even if it is empty. I have also just tried the stats(600) option in the configuration and stopped and started the dameon and this does not write any information to a log file - therefore no errors log file is created for the day. Does anyone know if this can be done on syslog-ng ??? Thanks > Gerhard Eggart > > >

2 1

Equivalent to syslog.conf -
by Tony Earnshaw 05 Sep '05

05 Sep '05

Hi list, Read all the docs (time and time again) and Googled, but still have no answer. Red Hat RHAS3, syslog-ng 1.6.8 (self-compiled on system, installed as an rpm) on this test server. I've come to appreciate syslog-ng and would not willingly go back to the original. But. My OpenLDAP 2.3.7 slapd log needs a "do not synchronize" possibility, similar to the syslog.conf - possibility, I *think* I've solved this by buffering output with sync: destination d_slapd { file("/var/log/slapd" sync(10)); }; Is this it, or could I do something better? Thanks! --Tonni -- mail: tonye(a)billy.demon.nl http://www.billy.demon.nl

2 2

Shiming Yang/OCIO_CorpDataSecurity/Planning_Office/HQ_for_the_Americas/BTMNA is out of the office.
by Shiming Yang 30 Aug '05

30 Aug '05

I will be out of the office starting 08/30/2005 and will not return until 09/03/2005. I will respond to your message when I return. If there is problem about Proxy or IBM web hosting facility, please call my backup Will at 8380 or Rich Maer at 5744. ----------------------------------------- The information contained in this electronic mail message, and any and all accompanying documents, constitutes confidential information. If you are not the intended recipient of this information, any disclosure, copying, distribution, or the taking of any action in reliance on it is strictly prohibited. If you received this information in error, please notify the sender immediately and destroy this communication. Messages sent via this medium may be subject to delays and/or unauthorized alteration. Neither The Bank of Tokyo-Mitsubishi, Ltd. nor any of its affiliates shall be held liable for the contents of this message.

1 0

Version question
by Tony Earnshaw 30 Aug '05

30 Aug '05

Hi, first post. Red Hat RHAS3 update 4. Saturday I downloaded libol 0.3.16 and syslog-ng 1.6.8 tarballs, saw immediately that there were rpm spec files and made rpms (not without an initial couple of barfs about missing MySQL stuff), which I installed. Took me Sunday and Monday till 10:00 am to get my head round it, but it's fantastic, thanks a lot:) So then I downloaded 1.9.5 and eventlog-0.2.3+20050116+1856. There were no rpm spec files, so I wrote my own (half a morning on the basis of the above ones, anyone who wants them's welcome to them), installed them and syslog-ng 1.9.5 crashed without trace. Used strace and couldn't for the life of me see what was happening. I couldn't be bothered to begin with gdb and back traces, so I put the good rpm back, all's back to normal. If anyone wants me to go ahead with debugging, I will (dilettantishly to say the least, I'm not a C programmer), but would rather not - 1.6.8 works fine for me. Just thought I'd let people know :) Best, --Tonni -- mail: tonye(a)billy.demon.nl http://www.billy.demon.nl

5 6

syslog-ng 1.9.5 segfaults on many platforms
by Paul Krizak 30 Aug '05

30 Aug '05

I've built both the daily snapshot from 2005-08-19 as well as the "stable" (I know it's not really stable) 1.9.5 on three platforms: RHEL4.1 x86_64 RHEL3.5 x86_64 Red Hat 7.3 2.4.29 i686 All three builds were with the default settings to ./configure. The build finishes without a hiccup but segfaults when syslog-ng tries to start. I've attached an strace (it's not very long...) to help show where it's segfaulting. The reason I need this to work is for the enhanced program() destination driver that will respawn programs that die. If somebody has a patch that backports this functionality to 1.6, that would be preferred, but a working 1.9.5 I could live with as well. Any ideas? -- Paul Krizak 5900 E. Ben White Blvd. MS 625 Advanced Micro Devices Austin, Tx 78741 CAD Systems Engineering Phone: (512) 602-8775 Paul.Krizak(a)amd.com Cell: (512) 791-0686

3 4

syslog-ng rpm spec files ...
by Tony Earnshaw 29 Aug '05

29 Aug '05

... need working on. Apart from anything else, the Source files syslog-ng.conf, syslog-ng.init and syslog-ng.sysconfig, as well as syslog-ng.conf for syslog-ng were simply copied from 1.6.8. Especially syslog-ng.conf should probably be that from the 1.9.5 tarball, but i didn't want to muck up my SOURCES directory, it was just a test. Feedback please - but preferably to the list, so that others may profit ;) Best, --Tonni -- mail: tonye(a)billy.demon.nl http://www.billy.demon.nl

1 0

tcp logging drops messages
by Stephen Harris 26 Aug '05

26 Aug '05

I was attempting to test the resiliency of syslog-ng to TCP server outages and notice that 2 messages can get lost. I have a simple configuration: Sending machine: Solaris 8, syslog-ng-1.6.8+20050826 Receiving machine: Linux (or Solaris, doesn't matter), ncat syslog-ng.conf: options { time_reopen(1); }; source from_file { pipe("/var/run/auth_log"); }; destination loghost { tcp("dest" port(1234)); }; log { source(from_file); destination(loghost);}; Sending machine: syslog-ng -F -d Receiving machine: ncat :1234 So far, so good; "echo msg1 > /var/run/auth_log" and I see the message on the receiving machine. Now kill ncat. Do "echo msg2 > /var/run/auth_log". No errors are seen. Now do a "echo msg3 > /var/run/auth_log". Now we see an error... io.c: do_write: write() failed (errno 32), Broken pipe pkt_buffer::do_flush(): Error flushing dataMarking fd 5 for closing. Connection broken to AF_INET(swharrislx1:1234), reopening in 1 seconds Closing fd 5. So far so good! Now another... "echo msg4 > /var/run/auth_log" Now another ... "echo msg5 > /var/run/auth_log". Now restart ncat. The ncat will show "msg4" and "msg5" happily. "msg2" and "msg3" are lost. Any ideas? -- rgds Stephen

2 1