- syslog-ng - lists.balabit.hu

install syslog-ng in Solaris 10 local zone
by nawirb 18 Jul '05

18 Jul '05

Hi expert, I have some question regarding install sylog-ng in Solaris 10 local zone. Will it work. Anyone have ever tried. thanks __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Putting all sending Hosts in a File
by Philipp Durrer 18 Jul '05

18 Jul '05

Thanks for the workaround for putting the hosts in a File. Now the Second thing i would to capture all networks which sending their logs to the syslog server. So i would to lookup the Networkid and netmask (subnetmask) of the sending host. And they should again logged into a file. greets Philipp Durrer (PS: Sorry for my bad english) ___________________________________________________________ Gesendet von Yahoo! Mail - Jetzt mit 1GB Speicher kostenlos - Hier anmelden: http://mail.yahoo.de

1 0

Problem with hostnames!
by mrgenius 16 Jul '05

16 Jul '05

Hi All! I am using Syslog-ng with php-syslog-ng. to give names of my choice to different hosts IP what i did was to define hostnames against each IP of host in /etc/hosts file. It was working fine with Public IP adresses.. But I have some hosts on local network too with 192.168 IPs . The pRoblem i am now facing is that its not storing logs with HOSTNAMES of private IPs. Where as its working fine and giving names of Public IPs. Any body has any idea?? any thing to do in configuration of syslog-ng?? Regards, -Geni

7 11

netmask() filter
by Al Tobey 14 Jul '05

14 Jul '05

I'm trying to use the netmask filter to create a separate logfile for all of our network devices (Cisco gear) logging to our central syslog-ng log sink. The interfaces doing the syslogging are all on specific subnets, so I'd like to filter on subnet rather than by hosts. Lo, and behold, syslog-ng has a netmask() filter. It doesn't appear to work, though, since none of the variations I've tried have managed to log anything near the correct data to the destination. I either get nothing or everything. For one thing, it'd be nice to see the documentation updated to specify whether to use cidr or dot notation (/24 v.s. 255.255.255.0). Using cidr notation resulted in no apparent filtering. Using dot notation caused nothing to land in the file. Is anybody else using this successfully that can share a working example? Am I missing something silly? syslog-ng version 1.6.8, libol 0.3.16 on RHEL 3 U4 Thanks, -Al Tobey options { sync (20); time_reopen (10); log_fifo_size (1000); log_msg_size(8192); long_hostnames (off); use_dns (yes); use_fqdn (no); use_time_recvd (no); create_dirs (no); keep_hostname (yes); dns_cache (yes); dns_cache_expire (6000); dns_cache_expire_failed (6000); dns_cache_size (128); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream("/dev/log"); internal(); }; source s_net { udp(); tcp(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/syslog/syslog.log" perm(0644)); }; destination d_warn { file("/var/log/syslog/syslog.warn" perm(0644)); }; destination d_mail { file("/var/log/syslog/mail.log" perm(0644)); }; destination d_auth { file("/var/log/syslog/auth.log"perm(0644)); }; destination d_netteam { file("/var/log/network-devices.log" perm(0644)); }; destination d_local { file("/var/log/messages" perm(0644)); }; destination logsurfer { program("/bin/su -s /bin/ksh syslogd -c '/usr/local/bin/logsurfer -c /usr/local/etc/logsurfer.conf -d /var/tmp/logsurfer.dump -'"); }; filter f_console { facility(kern); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_warn { level(warn..emerg) and not ( program("sshd") and match("we do not read, but chan_read_failed for istate 8") ) and not ( program("sshd") and match("Read from socket failed: Connection reset by peer") ); }; ######################################## filter f_netteam { netmask( "10.50.191.0/255.255.255.0" ); }; ######################################## # console messages on localhost log { source(s_sys); filter(f_console); destination(d_cons); }; # /var/log/messages log { source(s_sys); destination(d_local); }; # /var/log/syslog/syslog.log log { source(s_sys); source(s_net); destination(d_mesg); }; # /var/log/netowrk-devices.log log { source(s_net); filter(f_netteam); destination(d_netteam); }; # /var/log/syslog/auth.log log { source(s_sys); source(s_net); filter(f_auth); destination(d_auth); }; # /var/log/syslog/mail.log log { source(s_sys); source(s_net); filter(f_mail); destination(d_mail); }; # /var/log/syslog/syslog.warn log { source(s_sys); source(s_net); filter(f_warn); destination(d_warn); };

2 1

Re: [syslog-ng] HP-UX
by Michael Di Martino 13 Jul '05

13 Jul '05

Kkgk Regards, Michael Di Martino Director of MIS The telx Group Office: 212 480 3300 X.2022 Cell: 646 207 6603 mdm(a)telx.com -------------------------- Sent from my BlackBerry Wireless Handheld -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu <syslog-ng-bounces(a)lists.balabit.hu> To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Sent: Mon Jul 11 09:24:46 2005 Subject: RE: [syslog-ng] HP-UX Alessandro, I currently have version 1.6.6 running on multiple HP-UX 11i machines. I have not, however, attempted to upgrade to 1.6.8. Does it dump core during compilation or during execution once compiled? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alessandro Rocha Sent: Monday, July 11, 2005 9:14 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] HP-UX Hi All, I've tried to install the syslog-ng 1.6.8 on a HP-UX 11i server but it causes core dump during the initialization. Do you know if this version work with HP ? Thanks in advance. Alessandro. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Putting all sending Hosts in a File
by Philipp Durrer 13 Jul '05

13 Jul '05

Hi I'm new to syslog-ng and i would like to put all hosts which sending thier logs to the server in one file without the logs. So i got only the hostnames and/or Ip's in the file as a list (each line a new host ?). And the second list should contain all IP Networks of the senders. greets Nexus2k ___________________________________________________________ Gesendet von Yahoo! Mail - Jetzt mit 1GB Speicher kostenlos - Hier anmelden: http://mail.yahoo.de

1 0

syslog-ng keeps logging the same...
by Michael Mannsberger 12 Jul '05

12 Jul '05

I installed the following: libol-0.3.16 syslog-ng-1.6.8 I want to log to a loghost. If I specify udp as follows in the source statement udp(ip("0.0.0.0") port(514)); syslog-ng keeps logging the same entry over and over again. Without it it works fine for the loghost but clients will not be able to connect of course.

2 2

Problems with syslog-ng and filters-
by Ville Leinonen 12 Jul '05

12 Jul '05

Hi all, I have created 2 filters. There is check if there is link up/down text in msg field. If its match then there comes N else there should be comes N. My problem is now that i syslog-ng puts double in sql-table one is Y and one is N. Any suggestion what is wrong? Here comes also configuration. source net { udp(ip("0.0.0.0") port(514)); }; filter f_link_downup { match(LINK-3-UPDOWN) or match(LINEPROTO-5-UPDOWN) or match(off-line) or match(on-line); }; filter f_others { not match(LINK-3-UPDOWN) or not match(LINEPROTO-5-UPDOWN) or not match(off-line) or not match(on-line); }; log { source(net); filter(f_link_downup); destination(d_mysql_downup); }; log { source(net); filter(f_others); destination(d_mysql_others); }; destination d_mysql_downup { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg, showdata) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG', 'N' );\n") template-escape(yes)); }; destination d_mysql_others { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg, showdata) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG', 'Y' );\n") template-escape(yes)); }; Br, Ville Leinonen

2 2

RE: [syslog-ng] HP-UX
by Stephen Tanner 11 Jul '05

11 Jul '05

Alessandro, Did you install the libol from the HP Porting Archive? http://hpux.cs.utah.edu/ Stephen -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alessandro Rocha Sent: Monday, July 11, 2005 2:24 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] HP-UX Stephen, I´m still having problems. Any other idea ? Thanks. Alessandro. On 7/11/05, Stephen Tanner <stanner(a)leeclerk.org> wrote: > Alessandro, > I'm currently running libol 0.3.15 > > Stephen > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alessandro > Rocha > Sent: Monday, July 11, 2005 9:36 AM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] HP-UX > > Stephen, > > I intalled 1.6.6 but I got the same problem. > Do you know which libol version your servers are running ? > > Alessandro. > > On 7/11/05, Stephen Tanner <stanner(a)leeclerk.org> wrote: > > Alessandro, > > I currently have version 1.6.6 running on multiple HP-UX 11i > > machines. I have not, however, attempted to upgrade to 1.6.8. Does > it > > dump core during compilation or during execution once compiled? > > > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > Stephen Tanner > > HP-UX Systems Administrator > > Network Support Services > > Lee County Clerk of Courts > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > > > -----Original Message----- > > From: syslog-ng-bounces(a)lists.balabit.hu > > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alessandro > > Rocha > > Sent: Monday, July 11, 2005 9:14 AM > > To: syslog-ng(a)lists.balabit.hu > > Subject: [syslog-ng] HP-UX > > > > Hi All, > > > > I've tried to install the syslog-ng 1.6.8 on a HP-UX 11i server but it > > causes core dump during the initialization. Do you know if this > > version work with HP ? > > > > Thanks in advance. > > > > Alessandro. > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] HP-UX
by Stephen Tanner 11 Jul '05

11 Jul '05

Alessandro, I'm currently running libol 0.3.15 Stephen -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alessandro Rocha Sent: Monday, July 11, 2005 9:36 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] HP-UX Stephen, I intalled 1.6.6 but I got the same problem. Do you know which libol version your servers are running ? Alessandro. On 7/11/05, Stephen Tanner <stanner(a)leeclerk.org> wrote: > Alessandro, > I currently have version 1.6.6 running on multiple HP-UX 11i > machines. I have not, however, attempted to upgrade to 1.6.8. Does it > dump core during compilation or during execution once compiled? > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > Stephen Tanner > HP-UX Systems Administrator > Network Support Services > Lee County Clerk of Courts > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alessandro > Rocha > Sent: Monday, July 11, 2005 9:14 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] HP-UX > > Hi All, > > I've tried to install the syslog-ng 1.6.8 on a HP-UX 11i server but it > causes core dump during the initialization. Do you know if this > version work with HP ? > > Thanks in advance. > > Alessandro. > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1