- syslog-ng - lists.balabit.hu

Nothing is logged
by naim abu darwish 26 Aug '05

26 Aug '05

Hi, I'm trying to setup a central logging server to get logs from many hosts on a network, and store in a mysql database. I followed the following docs:: http://gentoo-wiki.com/HOWTO_setup_PHP-Syslog-NG http://vermeer.org/docs/1 only nothing is being logged :D my syslog-ng.conf so far:: # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.c onf.gentoo,v 1.5 2005/05/12 05:46:10 mr_bones_ Exp $ # # Syslog-ng default configuration file for Gentoo Linux # contributed by Michael Sterrett options { chain_hostnames(off); keep_hostname(yes); log_fifo_size(1024); sync(0); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; source shell { unix-dgram("/dev/log"); internal(); #tcp( port(5141) keep-alive(yes) max-connections(3000)); udp(ip(0.0.0.0 <http://0.0.0.0>),port(514)); }; source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; source net {udp(); }; destination messages { file("/var/log/messages"); }; # By default messages are logged to tty12... destination console_all { file("/dev/tty12"); }; # ...if you intend to use /dev/console for programs like xconsole # you can comment out the destination line above that references /dev/tty12 # and uncomment the line below. #destination console_all { file("/dev/console"); }; log { source(src); destination(messages); }; log { source(src); destination(console_all); }; log { source(shell); filter(allstuff);destination(testfile); }; log { source(net); destination(testfile); }; filter allstuff { host("194.146.*"); }; # pipe messages to /var/log/mysql.pipe to be processed by mysql destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; #destination testfile { destination testfile { file("/var/log/test/$HOST/zab.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; i suspected something wrong with the way i setup mysql database.. thats why i added the last bit, to log to a text file, still nothing .. i cant figure out what else could be wrong. Any help appreciated. Greets, Naim

2 1

syslog-ng on cygwin
by Gerardo Amaya 23 Aug '05

23 Aug '05

Hello all. I'm trying to install syslog-ng ver 1.6.8 on a cygwin enviroment. configure work smoothly, but when I run 'make' I got the following error: ************************************************************************ Making all in . make[3]: Entering directory `/home/Administrator/packages/syslog-ng-1.6.8/src' if gcc -DHAVE_CONFIG_H -I. -I/home/Administrator/packages/syslog-ng-1.6.8/src -I . -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -MT main.o -MD -MP - MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo '/home/Administrator/packages/syslog-ng -1.6.8/src/'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi main.c:49:20: resolv.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/home/Administrator/packages/syslog-ng-1.6.8/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/Administrator/packages/syslog-ng-1.6.8/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/home/Administrator/packages/syslog-ng-1.6.8/src' make: *** [all-recursive] Error 1 *************************************************************************** I check the src/ directory and indeed there is no resolv.h file. What can I do to resolve this issue. Thanks in advance. Gerardo Amaya

2 2

logging several to one facility - parsing
by Terry 19 Aug '05

19 Aug '05

Hello, I have several routers that I want to receive logs for. Can I send all the logs from these to a single facility and have syslog-ng parse and write them to different log files based on a ruleset such as ip address, type of log, etc. ? Thanks!

3 3

Error accepting AF_INET connection from
by Johannes.Trauttmansdorff＠commerzbank.com 17 Aug '05

17 Aug '05

Hi there, I am fairly new to syslog-ng and am very please of what I have seen so far. However, in case of a network outage between a sender and syslog-ng I do experience the following error message until I restart the syslog-ng daemon. I have searched the board but only found some old messages regarding a bug. Please advice. Jul 31 17:54:22 hostname syslog-ng[18336]: Error accepting AF_INET connection from: x.x.x.x:1124, opened connections: 10, max: 10 TX in advance, Joe

2 1

STATS: dropped with version 1.6.8 under rh el4
by Stephan Hendl 17 Aug '05

17 Aug '05

Hi all, recently I upgraded one of my central syslog servers from hpux to redhat el4 with syslog-ng-1.6.8-1 and get from time to time messages like Aug 10 11:43:57 pns1 syslog-ng[10542]: STATS: dropped 19 Aug 10 11:48:57 pns1 syslog-ng[10542]: STATS: dropped 45 Aug 10 11:53:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 11:58:57 pns1 syslog-ng[10542]: STATS: dropped 36 Aug 10 12:03:57 pns1 syslog-ng[10542]: STATS: dropped 7 Aug 10 12:08:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:13:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:18:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:23:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:28:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:33:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:38:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:43:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:48:57 pns1 syslog-ng[10542]: STATS: dropped 37 Aug 10 12:53:57 pns1 syslog-ng[10542]: STATS: dropped 52 Aug 10 12:58:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 13:03:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 13:08:57 pns1 syslog-ng[10542]: STATS: dropped 51 Aug 10 13:13:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 13:18:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 13:23:57 pns1 syslog-ng[10542]: STATS: dropped 11 Aug 10 13:28:57 pns1 syslog-ng[10542]: STATS: dropped 1 Aug 10 13:33:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 13:38:57 pns1 syslog-ng[10542]: STATS: dropped 0 There are 5 servers who are sending their syslog messages via tcp an one 2 servers who are sending via udp to that central server. The load of the machine (2xXenon CPU, 3 GHz, 1 GB RAM) is really low. For revison purposes (maillogdata) I have to keep _all_ syslog lines!!! What can I change in order to avoid dropped lines? Stephan top - 15:39:06 up 36 days, 1:49, 2 users, load average: 0.10, 0.09, 0.04 Tasks: 194 total, 1 running, 193 sleeping, 0 stopped, 0 zombie Cpu(s): 0.3% us, 0.2% sy, 0.0% ni, 99.2% id, 0.4% wa, 0.0% hi, 0.0% si Mem: 1034692k total, 1018520k used, 16172k free, 141372k buffers Swap: 2096440k total, 144k used, 2096296k free, 602228k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 690 root 16 0 43644 4784 2180 S 0.7 0.5 129:42.96 nco_p_syslog 779 root 16 0 43644 4784 2180 S 0.3 0.5 254:33.32 nco_p_syslog 10542 root 15 0 1876 1048 776 S 0.3 0.1 6:59.31 syslog-ng 1 root 16 0 3236 548 472 S 0.0 0.1 0:00.96 init 2 root RT 0 0 0 0 S 0.0 0.0 0:04.37 migration/0 3 root 34 19 0 0 0 S 0.0 0.0 0:00.06 ksoftirqd/0 4 root RT 0 0 0 0 S 0.0 0.0 0:03.11 migration/1 5 root 34 19 0 0 0 S 0.0 0.0 0:00.02 ksoftirqd/1 My syslog-ng.conf looks like: root@pns1:~# vi /etc/syslog-ng/syslog-ng.conf # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat Linux 9. # But it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. options {sync (0); time_reopen (10); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats (300); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; source s_tcp { tcp(ip(a.b.c.d) port(10514) keep-alive(no)); }; source s_udp { udp(ip(a.b.c.d) port(514)); }; # Log all kernel messages to the console. # Logging much else clutters up the screen. #destination d_cons { file("/dev/console"); }; #filter f_cons { facility(kern); }; #log { source(s_sys); filter(f_cons); destination(d_cons); }; # Log anything (except mail) of level info or higher. # Don't log private authentication messages! destination d_mesg { file("/var/log/messages"); }; filter f_mesg { not facility(mail,news,authpriv,cron) and level(emerg..info); }; log { source(s_sys); filter(f_mesg); destination(d_mesg); }; # The authpriv file has restricted access. destination d_auth { file("/var/log/secure"); }; filter f_auth { facility(authpriv); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; # Log all the mail messages in one place. destination d_mail { file("/var/log/maillog" template( "$DATE $HOST $MESSAGE\n")); }; filter f_mail { facility(mail); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; # Log cron stuff. destination d_cron { file("/var/log/cron"); }; filter f_cron { facility(cron); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; # Everybody gets emergency messages. destination d_mlal { usertty("*"); }; filter f_mlal { level(emerg); }; log { source(s_sys); filter(f_mlal); destination(d_mlal); }; # Save news errors of level crit and higher in a special file. destination d_spol { file("/var/log/spooler"); }; filter f_spol {facility(uucp) or facility(news) and level(emerg..crit); }; log { source(s_sys); filter(f_spol); destination(d_spol); }; # Save boot messages also to boot.log. destination d_boot { file("/var/log/boot.log"); }; filter f_boot { facility(local7); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; # Save all mesages to syslog.lvnbb.de destination d_tcp { tcp("localhost" port(10514)); }; log { source(s_sys); destination(d_tcp); }; log { source(s_tcp); destination(d_tcp); }; log { source(s_udp); destination(d_tcp); }; # Save all messages to pipe /tmp/cic.pipe destination d_cic { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template("$DATE $HOST $MESSAGE\n") template-escape(yes)); }; log { source(s_sys); destination(d_cic); }; log { source(s_tcp); destination(d_cic); }; log { source(s_udp); destination(d_cic); };

3 2

Send logs to upd syslog and rewrite facility
by Damien_DeVille＠discovery.com 17 Aug '05

17 Aug '05

I'm in a position where I've got a device that uses syslog-ng to filter multiple events into multiple diferent log files. I need to send the logs to a central udp syslog server and would like to have all events from this particular device show up as coming from a specific facility (say local3) so that they get put into the correct logfile on the central server. I've figured out that I have to define a destination, filter, and log in syslog-ng.conf but I haven't figured out how to mark all the logs to that destination with a specific facility. Is that possible? For reference here's what I'm looking at in terms of destination, filter, and log definitions in syslog-ng.conf: destination d_logger { udp ("xxx.xxx.xxx.xxx" port(514)); }; filter f_all_logs_net { facility(auth,authpriv,kern,user,daemon,local0 .. local7) and level(warn .. emerg); }; log { source(syslog-ng); filter (f_all_logs_net); destination(d_logger); }; Thanks in advance. -- -Damien Damien DeVille IT Network Engineer This e-mail, and any attachment, is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, re-transmission, copying, dissemination or other use of this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. The contents of this message may contain personal views which are not the views of Discovery Communications, Inc. (DCI).

2 1

Question - Spoof_source in TCP()
by Gerardo Amaya 16 Aug '05

16 Aug '05

Hello all. Is there a way to have spoof_source functionallity option in syslog-ng TCP connections? Is this a feature for future syslog-ng releases? Thanks in advance Gerardo Amaya

3 2

filter...?
by Bjørn T Johansen 15 Aug '05

15 Aug '05

I have a filter looking like this: filter f_cyrus { program("imap") or program("master") or program("lmtpunix") or program("ctl_cyrusdb"); }; But it doesn't work 100%.... I get the log from imap and lmtpunix and ctl_cyrusdb, but not for master... Why not? Regards, BTJ -- ----------------------------------------------------------------------------------------------- Bjørn T Johansen btj(a)havleik.no ----------------------------------------------------------------------------------------------- Someone wrote: "I understand that if you play a Windows CD backwards you hear strange Satanic messages" To which someone replied: "It's even worse than that; play it forwards and it installs Windows" -----------------------------------------------------------------------------------------------

1 0

Re: Antw: Re: [syslog-ng] STATS: dropped with version 1.6.8 underrh el4
by Stephan Hendl 12 Aug '05

12 Aug '05

The host 'pns1' is a - let's say a syslog repeater. It gets messages from 5 hosts via tcp (two of these five are mailservers and send the maiilog via syslog-ng) and from 2 hosts as well as an internet router/firewall via udp. The syslog-ng writes the lines into files as well as into a pipe where a third program read the lines and evaluates they according to given patterns. Additionally the syslog-ng sends all messages through a ssh tunnel to another syslog-ng. This is the whole situation.Aafter including the "log_fifo_size (128056);" parameter there were no dropped lines anymore. Stephan >>> ken.garland(a)rotech.com 11.08.2005 14:52:34 >>> Mike Tremaine wrote: >On Wed, 2005-08-10 at 07:21, Stephan Hendl wrote: > > >>the lines with values "STATS: dropped <!=0>" are very annoying. How >>can I prevent the syslog-ng from dropping lines??? I put the line >>"log_fifo_size(1000);" into the global section - hope that helps ;-))) >> >> >> > >If the hosts only job is syslog-ng go for broke and kick it up to >something higher then 1000. > >log_fifo_size (128056); > >[I used that when I was doing some testing with an old AMD-k62 500mhz >256MB and FC3, it ran with 5 hosts sending as fast as the could to it. >Didn't drop anything.] > > > > I have about 15 systems logging to my syslog-ng server and some of them are routers which send a ton of messages about up/down link state. This server is getting smashed with logs and I have not received any dropped messages other than the 'DROPPED 0' which is a good thing that the syslog-ng host is saying it has not dropped any log packets. I would think something else is going on here and the fifo would not need to be increased as my fifo setting is only at 1024. In your first message you pasted something from the host 'pns1' which was complaining about dropping multiple packets. What is this system and is it running syslog-ng, also what connection is it using? tcp/udp? Are there other hosts which are sending out dropped log messages or only pns1? - Ken _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Damien DeVille is out of the office.
by Damien_DeVille＠discovery.com 12 Aug '05

12 Aug '05

I will be out of the office starting 08/12/2005 and will not return until 08/29/2005. I will be out on vacation in 8/12. I will be in training the week of the 15th, and I will be on vacation the week of the 22nd. In my absence, please contact Chris Butler. This e-mail, and any attachment, is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, re-transmission, copying, dissemination or other use of this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. The contents of this message may contain personal views which are not the views of Discovery Communications, Inc. (DCI).

1 0