- syslog-ng - lists.balabit.hu

Duplicate Messages in line.
by Ricardo A Reis 27 Jul '05

27 Jul '05

Hi all, I've a problem with squid and loghost saw tail |logger , apparently i have duplicate entry in the same line. Log output, -------------------- 11:42:46 arapacu.epm.br [user.notice] squid_access: 1122475366.008 220 172.16.160.185 TCP_MISS/200 437 GET http://kh.google.com/flatfile? - DIRECT/216.239.39.93 application/octet-stream squid_access: 1122475366.008 220 172.16.160.185 TCP_MISS/200 437 GET http://kh.google.com/flatfile? - DIRECT/216.239.39.93 application/octet-stream -------------------- syslog-ng resume, -------------------------------------------------------- options { sync(0); use_fqdn(yes); keep_hostname(yes); chain_hostnames(no); long_hostnames(no); create_dirs(yes); group(syslog); dir_group(syslog); perm(0640); dir_perm(0750); stats(3600); time_reopen(10); log_msg_size(10240); log_fifo_size(4096); dns_cache(yes); use_dns(yes); stats (3600); mark (600); bad_hostname("gconfd"); }; source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; source s_stunnel { tcp(ip("127.0.0.1") port(514) keep-alive(yes) max-connections(300)); }; source s_udp { udp(); }; destination r_squida { file ("/syslog/clients/$HOST/squid_access/$YEAR.$MONTH.$DAY" template("$HOUR:$MIN:$SEC $HOST [$FACILITY.$PRIORITY] $MSG $MSG\n") template_escape(no)); }; filter f_squida { match ("squid_access"); }; log { source(src); source(s_udp); source(s_stunnel); filter(f_squida); destination(r_squida); flags(final); }; Thanks for Advanced, Atenciosamente Ricardo A. Reis UNIFESP - SENAI

1 0

configuration of syslog-ng.conf
by javier rojas 27 Jul '05

27 Jul '05

hello, is there a manual or a guide on how to configure syslog-ng.conf file?, i'm having some big trouble starting the server and i guess it's because missconfiguration on the conf file... thanx...! -- Ciao,Javier linux user #393724

1 0

RE: [syslog-ng] syslog starting trouble
by Kelly Pow 26 Jul '05

26 Jul '05

Hi, Can you send you syslog.conf file please? I am suspecting that " CONSOLE_LOG_LEVEL is of unaccepted value" is not valid. The levels are: Ie level (): Debug Info Notice Warning Err Crit Alert Emerg Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of javier rojas Sent: Tuesday, July 26, 2005 12:48 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog starting trouble hello, i just installed syslog-ng in my debian box, but i can't seem to be able to start it, each time i get the same error: jrojas:/etc/init.d# /etc/init.d/syslog-ng stop # Stop syslog-ng CONSOLE_LOG_LEVEL is of unaccepted value. KERNEL_RINGBUF_SIZE is of unaccepted value. Stopping system logging: syslog-ng not running. does anybody knows why i-m getting this error? or even better..... does anybody knows how to fix it? i got nothing from google..... -- Ciao,Javier _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

syslog-ng and netfilter() problem
by Kelly Pow 26 Jul '05

26 Jul '05

Hi, . I am trying to use syslog-ng to collect syslogs from routers, but I would like the logs from the same network to be logged in one file IE: all logs from 66.163.79.0/25 and 64.251.65.224/28 --> to be stored in /ipbb All logs from 204.209.214.0/23 --> to be stored in /ipbb_lab How can I do this using syslog-ng? How do I log IP addresses of the same network into the same file? There is a filter in syslog-ng called netmask() --it checks the sender's IP address to see whether it is in the specified IP subnet Syntax: netmask(ip/mask) So I created a filter see below: filter f_ipbb { netmask("66.163.79.0/25"); }; So my logic on this was If the syslog is from an IP address in this network/subnet then it should get logged to where I specified it to.... Unfortunately: As seen below I got syslogs from the following IP addresses: root@K3 store # ls 64.251.65.229 66.163.79.2 66.163.79.37 66.163.79.42 But the file only logged one syslog : root@K3 test # cat syslogs/2005-07-25 Jul 25 13:37:52 66.163.79.2/66.163.79.2 34118: Jul 25 13:38:15.053 MDT: %BGP-4-MAXPFX: No. of prefix received from 206.223.116.11 (afi 0) reaches 5893, max 7000 Do you have any idea why? As seen below, I have tried: filter f_test { netmask("66.163.79.0/255.255.255.128"); }; <-- gives no results filter f_ipbb { netmask("66.163.79.0/25"); };<-- only give syslogs from 66.163.79.2 Any thing that I might be doing wrong that I can't see? Is there a bug with syslog-ng? Thank you very much Kelly :-) Below is my syslog-ng.conf file: Syslog-ng/conf file: ******************************************************************** options { long_hostnames(yes); keep_hostname(yes); use_fqdn(on); create_dirs(yes); owner(nmadmin); group(users); perm(0755); dir_owner(nmadmin); dir_group(users); dir_perm(0755); sync(0); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #filter for ipbb filter f_ipbb { netmask("66.163.79.0/25"); }; filter f_ipbb2 { netmask("64.251.65.224/28"); }; #test configuration for loggin cisco devices source net { udp(); }; destination ipbb_lab_syslogs { file("/store/ipbb_lab/syslogs/$YEAR-$MONTH-$DAY"); }; destination ipbb_syslogs { file("/store/test/syslogs/$YEAR-$MONTH-$DAY"); }; destination all { file("/store/$HOST"); }; log { source(net); destination(all); }; log { source(net); filter(f_ipbb); destination(ipbb_syslogs); }; <-- only collects syslogs from 66.163.79.2 log { source(net); destination(ipbb_lab_syslogs); }; #testing for stripping filter f_test { netmask("66.163.79.0/255.255.255.128"); }; destination d_test { file("/store/test1"); }; log { source(src);filter(f_test); destination(d_test); }; <--Gives no results #for SNMPTRAP destination ipbb_lab_traps { file("/store/ipbb_lab/traps/$YEAR-$MONTH-$DAY"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; #filter snmptrap filter f_snmptrap { level(warn); }; log { source(src); filter (f_snmptrap); destination(ipbb_lab_traps); }; <-- In test Mode- Traps also needs to be filtered to be stored in their network file log { source(src); filter (f_snmptrap); filter(f_ipbb); filter(f_ipbb2); destination(ipbb_traps); }; **************************************************************************** **************************************************************************** ******************************** Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca>

1 0

Sending Net-SNMP Traps w/ syslog-ng (revisited)
by Brian A. Seklecki 25 Jul '05

25 Jul '05

I want syslog-ng to call snmptrap on certain filter conditions, such as auth.warn or kern.crit, etc. I can handle the syslog-ng syntax, it's the program() arguments. See: https://lists.balabit.hu/pipermail/syslog-ng/2003-September/005432.html There hasn't been much discussion on either list since this post. 1) What are good values for "[OID TYPE VALUE]" as arguments to snmptrap(1) (either called from sendtrap.sh or directly from syslog-ng) 2) Perhaps there's a more logical way to investigate this? Using snmpwalk(1) for example? TIA || l8* -lava x.25 - minix - bitnet - plan9 - 110 bps - ASR 33 - base8

1 0

libol compile error in Solaris 10 Intel
by nawirb 21 Jul '05

21 Jul '05

I am sorry, It's working after I put /usr/ccs/bin in PATH thank you __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

libol compile error in Solaris 10 Intel
by nawirb 21 Jul '05

21 Jul '05

Dear expert, I got error during make command when compiling libol 0.3.16 in sol10 x86. I am using gcc 3.36 from sunfreeware Any idea how to solve the problem # crle /lib:/usr/lib:/usr/sfw/lib:/usr/sfw/lib/amd64:/usr/local/lib # cat /.profile PATH=/usr/local/bin:/usr/local/sbin:/bin:/sbin:/usr/bin:/usr/sbin;export PATH # pkginfo|grep SMC SMCautoc SMCautom SMCdb SMCexpat SMCflex SMCgcc336 SMCgd SMCgdbm SMCglib SMCiconv SMClibt SMClpng SMCm4 SMCmake SMCzlib bash-3.00# make Making all in utils make[1]: Entering directory `/export/home/nawir/libol-0.3.16/utils' sed -e "s,_SCSH_,/usr/bin/scsh," make_class.in >make_class chmod +x make_class make[1]: Leaving directory `/export/home/nawir/libol-0.3.16/utils' Making all in src make[1]: Entering directory `/export/home/nawir/libol-0.3.16/src' make all-am make[2]: Entering directory `/export/home/nawir/libol-0.3.16/src' if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT format.lo -MD -MP -MF ".deps/format.Tpo" \ -c -o format.lo `test -f 'format.c' || echo '/export/home/nawir/libol-0.3.16/src/'`format.c; \ then mv -f ".deps/format.Tpo" ".deps/format.Plo"; \ else rm -f ".deps/format.Tpo"; exit 1; \ fi mkdir .libs gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT format.lo -MD -MP -MF .deps/format.Tpo -c format.c -fPIC -DPIC -o .libs/format.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT format.lo -MD -MP -MF .deps/format.Tpo -c format.c -o format.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT io.lo -MD -MP -MF ".deps/io.Tpo" \ -c -o io.lo `test -f 'io.c' || echo '/export/home/nawir/libol-0.3.16/src/'`io.c; \ then mv -f ".deps/io.Tpo" ".deps/io.Plo"; \ else rm -f ".deps/io.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT io.lo -MD -MP -MF .deps/io.Tpo -c io.c -fPIC -DPIC -o .libs/io.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT io.lo -MD -MP -MF .deps/io.Tpo -c io.c -o io.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT werror.lo -MD -MP -MF ".deps/werror.Tpo" \ -c -o werror.lo `test -f 'werror.c' || echo '/export/home/nawir/libol-0.3.16/src/'`werror.c; \ then mv -f ".deps/werror.Tpo" ".deps/werror.Plo"; \ else rm -f ".deps/werror.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT werror.lo -MD -MP -MF .deps/werror.Tpo -c werror.c -fPIC -DPIC -o .libs/werror.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT werror.lo -MD -MP -MF .deps/werror.Tpo -c werror.c -o werror.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT queue.lo -MD -MP -MF ".deps/queue.Tpo" \ -c -o queue.lo `test -f 'queue.c' || echo '/export/home/nawir/libol-0.3.16/src/'`queue.c; \ then mv -f ".deps/queue.Tpo" ".deps/queue.Plo"; \ else rm -f ".deps/queue.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT queue.lo -MD -MP -MF .deps/queue.Tpo -c queue.c -fPIC -DPIC -o .libs/queue.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT queue.lo -MD -MP -MF .deps/queue.Tpo -c queue.c -o queue.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT abstract_io.lo -MD -MP -MF ".deps/abstract_io.Tpo" \ -c -o abstract_io.lo `test -f 'abstract_io.c' || echo '/export/home/nawir/libol-0.3.16/src/'`abstract_io.c; \ then mv -f ".deps/abstract_io.Tpo" ".deps/abstract_io.Plo"; \ else rm -f ".deps/abstract_io.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT abstract_io.lo -MD -MP -MF .deps/abstract_io.Tpo -c abstract_io.c -fPIC -DPIC -o .libs/abstract_io.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT abstract_io.lo -MD -MP -MF .deps/abstract_io.Tpo -c abstract_io.c -o abstract_io.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT gc.lo -MD -MP -MF ".deps/gc.Tpo" \ -c -o gc.lo `test -f 'gc.c' || echo '/export/home/nawir/libol-0.3.16/src/'`gc.c; \ then mv -f ".deps/gc.Tpo" ".deps/gc.Plo"; \ else rm -f ".deps/gc.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT gc.lo -MD -MP -MF .deps/gc.Tpo -c gc.c -fPIC -DPIC -o .libs/gc.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT gc.lo -MD -MP -MF .deps/gc.Tpo -c gc.c -o gc.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT list.lo -MD -MP -MF ".deps/list.Tpo" \ -c -o list.lo `test -f 'list.c' || echo '/export/home/nawir/libol-0.3.16/src/'`list.c; \ then mv -f ".deps/list.Tpo" ".deps/list.Plo"; \ else rm -f ".deps/list.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT list.lo -MD -MP -MF .deps/list.Tpo -c list.c -fPIC -DPIC -o .libs/list.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT list.lo -MD -MP -MF .deps/list.Tpo -c list.c -o list.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT read_line.lo -MD -MP -MF ".deps/read_line.Tpo" \ -c -o read_line.lo `test -f 'read_line.c' || echo '/export/home/nawir/libol-0.3.16/src/'`read_line.c; \ then mv -f ".deps/read_line.Tpo" ".deps/read_line.Plo"; \ else rm -f ".deps/read_line.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT read_line.lo -MD -MP -MF .deps/read_line.Tpo -c read_line.c -fPIC -DPIC -o .libs/read_line.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT read_line.lo -MD -MP -MF .deps/read_line.Tpo -c read_line.c -o read_line.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT xalloc.lo -MD -MP -MF ".deps/xalloc.Tpo" \ -c -o xalloc.lo `test -f 'xalloc.c' || echo '/export/home/nawir/libol-0.3.16/src/'`xalloc.c; \ then mv -f ".deps/xalloc.Tpo" ".deps/xalloc.Plo"; \ else rm -f ".deps/xalloc.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT xalloc.lo -MD -MP -MF .deps/xalloc.Tpo -c xalloc.c -fPIC -DPIC -o .libs/xalloc.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT xalloc.lo -MD -MP -MF .deps/xalloc.Tpo -c xalloc.c -o xalloc.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT alist.lo -MD -MP -MF ".deps/alist.Tpo" \ -c -o alist.lo `test -f 'alist.c' || echo '/export/home/nawir/libol-0.3.16/src/'`alist.c; \ then mv -f ".deps/alist.Tpo" ".deps/alist.Plo"; \ else rm -f ".deps/alist.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT alist.lo -MD -MP -MF .deps/alist.Tpo -c alist.c -fPIC -DPIC -o .libs/alist.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT alist.lo -MD -MP -MF .deps/alist.Tpo -c alist.c -o alist.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT stream_buffer.lo -MD -MP -MF ".deps/stream_buffer.Tpo" \ -c -o stream_buffer.lo `test -f 'stream_buffer.c' || echo '/export/home/nawir/libol-0.3.16/src/'`stream_buffer.c; \ then mv -f ".deps/stream_buffer.Tpo" ".deps/stream_buffer.Plo"; \ else rm -f ".deps/stream_buffer.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT stream_buffer.lo -MD -MP -MF .deps/stream_buffer.Tpo -c stream_buffer.c -fPIC -DPIC -o .libs/stream_buffer.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT stream_buffer.lo -MD -MP -MF .deps/stream_buffer.Tpo -c stream_buffer.c -o stream_buffer.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT pkt_buffer.lo -MD -MP -MF ".deps/pkt_buffer.Tpo" \ -c -o pkt_buffer.lo `test -f 'pkt_buffer.c' || echo '/export/home/nawir/libol-0.3.16/src/'`pkt_buffer.c; \ then mv -f ".deps/pkt_buffer.Tpo" ".deps/pkt_buffer.Plo"; \ else rm -f ".deps/pkt_buffer.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT pkt_buffer.lo -MD -MP -MF .deps/pkt_buffer.Tpo -c pkt_buffer.c -fPIC -DPIC -o .libs/pkt_buffer.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT pkt_buffer.lo -MD -MP -MF .deps/pkt_buffer.Tpo -c pkt_buffer.c -o pkt_buffer.o >/dev/null 2>&1 if /bin/bash ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT resource.lo -MD -MP -MF ".deps/resource.Tpo" \ -c -o resource.lo `test -f 'resource.c' || echo '/export/home/nawir/libol-0.3.16/src/'`resource.c; \ then mv -f ".deps/resource.Tpo" ".deps/resource.Plo"; \ else rm -f ".deps/resource.Tpo"; exit 1; \ fi gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT resource.lo -MD -MP -MF .deps/resource.Tpo -c resource.c -fPIC -DPIC -o .libs/resource.o gcc -DHAVE_CONFIG_H -I. -I/export/home/nawir/libol-0.3.16/src -I. -D_GNU_SOURCE -D_XOPEN_SOURCE_EXTENDED -Wall -g -MT resource.lo -MD -MP -MF .deps/resource.Tpo -c resource.c -o resource.o >/dev/null 2>&1 /bin/bash ../libtool --mode=link gcc -Wall -g -o libol.la -rpath /usr/local/lib format.lo io.lo werror.lo queue.lo abstract_io.lo gc.lo list.lo read_line.lo xalloc.lo alist.lo stream_buffer.lo pkt_buffer.lo resource.lo -lsocket -lnsl -lxnet gcc -shared -Wl,-h -Wl,libol.so.0 -o .libs/libol.so.0.0.0 .libs/format.o .libs/io.o .libs/werror.o .libs/queue.o .libs/abstract_io.o .libs/gc.o .libs/list.o .libs/read_line.o .libs/xalloc.o .libs/alist.o .libs/stream_buffer.o .libs/pkt_buffer.o .libs/resource.o -lsocket -lnsl -lxnet -lc (cd .libs && rm -f libol.so.0 && ln -s libol.so.0.0.0 libol.so.0) (cd .libs && rm -f libol.so && ln -s libol.so.0.0.0 libol.so) false cru .libs/libol.a format.o io.o werror.o queue.o abstract_io.o gc.o list.o read_line.o xalloc.o alist.o stream_buffer.o pkt_buffer.o resource.o make[2]: *** [libol.la] Error 1 make[2]: Leaving directory `/export/home/nawir/libol-0.3.16/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/export/home/nawir/libol-0.3.16/src' make: *** [all-recursive] Error 1 __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

syslog-ng and host() filters regex problem
by syslog-ng 19 Jul '05

19 Jul '05

hello, I have a problem with syslog-ng and host() filters regex. I need to sort out logs coming from different source addresses in various files, so I started with this configuration: filter f_cp_ { host("10.28.88.4"); }; [10 similar host filters] filter f_pix_1 { host("10.29.42.3"); }; for every filter I defined a file destination and a log statement like this one: log { source(s_udp); filter(f_pix_1); destination(nfs_pix_1); }; This configuration works as expected, but since logs might come from other IP addresses which don't have to get mixed up (eg 10.28.88.41 matches the first filter but shouldn't) I'd like to use a regexp in the host file; I tried just by adding a $ at the end of the IP, like this: filter f_cp_dl380 { host("10.28.88.4$"); }; [10 similar host filters] filter f_pix_1VF { host("10.29.42.3$"); }; After sending a HUP to the process syslog-ng stops writing input packets to the various log files. Just removing the $ after the ip address and sending another HUP to the server restores functionality. I also tried with a full IP regexp, as found in another post on the list (host("^10\.28\.88\.4$")) but the result is the same. I also tried upgrading my syslog-ng from 1.6.2 to 1.6.8 but nothing changed. It seems like the config parser is somehow unable to manage more than a handful of host regexps correctly. I can provide full configuration files if needed. thanks for the help, Stefania

2 1

RE: [syslog-ng] syslog-ng and host() filters regex problem
by Michael Di Martino 18 Jul '05

18 Jul '05

Si -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng Sent: Monday, July 18, 2005 5:23 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng and host() filters regex problem hello, I have a problem with syslog-ng and host() filters regex. I need to sort out logs coming from different source addresses in various files, so I started with this configuration: filter f_cp_ { host("10.28.88.4"); }; [10 similar host filters] filter f_pix_1 { host("10.29.42.3"); }; for every filter I defined a file destination and a log statement like this one: log { source(s_udp); filter(f_pix_1); destination(nfs_pix_1); }; This configuration works as expected, but since logs might come from other IP addresses which don't have to get mixed up (eg 10.28.88.41 matches the first filter but shouldn't) I'd like to use a regexp in the host file; I tried just by adding a $ at the end of the IP, like this: filter f_cp_dl380 { host("10.28.88.4$"); }; [10 similar host filters] filter f_pix_1VF { host("10.29.42.3$"); }; After sending a HUP to the process syslog-ng stops writing input packets to the various log files. Just removing the $ after the ip address and sending another HUP to the server restores functionality. I also tried with a full IP regexp, as found in another post on the list (host("^10\.28\.88\.4$")) but the result is the same. I also tried upgrading my syslog-ng from 1.6.2 to 1.6.8 but nothing changed. It seems like the config parser is somehow unable to manage more than a handful of host regexps correctly. I can provide full configuration files if needed. thanks for the help, Stefania _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng filtering db inserts
by Edward Brookhouse 18 Jul '05

18 Jul '05

Hi all - Anyone know how to setup the syslog-ng conf file so that certain events can be filtered from being inserted into the db ? i.e. I am setup now with various log { source(src); filter(f_mail); destination(mailwarn); }; type rules - this works great - I can filter any log message into any folder - Later in my conf I have: log { source(src); destination(d_mysql); }; Which tosses everything into the db - but how do I tell it to take everything except for given filters? Any thoughts appreciated, Edward

1 0