- syslog-ng - lists.balabit.hu

Question
by Alessandro Rocha 31 May '05

31 May '05

Hi All, Do you know if it is possible to redirect syslog logs to an oracle database ? If it is possible, do you know where i can find a how to ? Thanks in advance. Alessandro.

2 1

meaning internal message
by torpedo 31 May '05

31 May '05

Hi all, syslog-ng generates internal message => May 31 10:33:39 inter@abc syslog-ng[3841]: STATS: dropped 0 What does this message means ? Where can I find,what all internal messages does the syslog-ng generates and their meanings. thanks in advance. regards, torpedo

2 1

syslog-ng and windows
by JF Suret 30 May '05

30 May '05

Hello, I'm using syslog-ng as a central log server, and I have both linux and windows clients. I know that there are some syslog windows clients ( NTsyslog, snare) but I can't find any open source syslog-ng clients. What I'm looking for is (at least if it does not exist) information on the TCP data format used by syslog-ng. So I could write a little udp to tcp syslog translator that could be used on windows clients (and maybe modify NTsyslog if I have enought time...) Thanks JF

2 1

Re: [Filter Test: C10] Re: [syslog-ng] Program Filters
by Metal Gear 30 May '05

30 May '05

Hi, thank u guys for the help actually i missed two of posts of Mr. Nate following the instructions in the post have no problem. Now i have the logs that i wanted thanks again

1 0

Error logging to MySQL
by Colin O'Keeffe 29 May '05

29 May '05

I get syntax error at 132 Parse error reading configuratin file, exiting. (line 132) when i do syslog-ng start heres my config file.... # # Configuration file for syslog-ng under Debian # # attempts at reproducing default syslog behavior # the standard syslog levels are (in descending order of priority): # emerg alert crit err warning notice info debug # the aliases "error", "panic", and "warn" are deprecated # the "none" priority found in the original syslogd configuration is # only used in internal messages created by syslogd ###### # options options { # disable the chained hostname format in logs # (default is enabled) chain_hostnames(0); # the time to wait before a died connection is re-established # (default is 60) time_reopen(10); # the time to wait before an idle destination file is closed # (default is 60) time_reap(360); # the number of lines buffered before written to file # you might want to increase this if your disk isn't catching with # all the log messages you get or if you want less disk activity # (say on a laptop) # (default is 0) #sync(0); # the number of lines fitting in the output queue log_fifo_size(2048); # enable or disable directory creation for destination files create_dirs(yes); # default owner, group, and permissions for log files # (defaults are 0, 0, 0600) #owner(root); group(adm); perm(0640); # default owner, group, and permissions for created directories # (defaults are 0, 0, 0700) #dir_owner(root); #dir_group(root); dir_perm(0755); # enable or disable DNS usage # syslog-ng blocks on DNS queries, so enabling DNS may lead to # a Denial of Service attack # (default is yes) use_dns(no); # maximum length of message in bytes # this is only limited by the program listening on the /dev/log Unix # socket, glibc can handle arbitrary length log messages, but -- for # example -- syslogd accepts only 1024 bytes # (default is 2048) #log_msg_size(2048); }; ###### # sources # all known message sources source s_all { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) #unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); # use the above line if you want to receive remote UDP logging messages # (this is equivalent to the "-r" syslogd flag) # udp(); }; ###### # destinations # some standard log files destination df_auth { file("/var/log/auth.log"); }; destination df_syslog { file("/var/log/syslog"); }; destination df_cron { file("/var/log/cron.log"); }; destination df_daemon { file("/var/log/daemon.log"); }; destination df_kern { file("/var/log/kern.log"); }; destination df_lpr { file("/var/log/lpr.log"); }; destination df_mail { file("/var/log/mail.log"); }; destination df_user { file("/var/log/user.log"); }; destination df_uucp { file("/var/log/uucp.log"); }; # these files are meant for the mail system log files # and provide re-usable destinations for {mail,cron,...}.info, # {mail,cron,...}.notice, etc. destination df_facility_dot_info { file("/var/log/$FACILITY.info"); }; destination df_facility_dot_notice { file("/var/log/$FACILITY.notice"); }; destination df_facility_dot_warn { file("/var/log/$FACILITY.warn"); }; destination df_facility_dot_err { file("/var/log/$FACILITY.err"); }; destination df_facility_dot_crit { file("/var/log/$FACILITY.crit"); }; # these files are meant for the news system, and are kept separated # because they should be owned by "news" instead of "root" destination df_news_dot_notice { file("/var/log/news/news.notice" owner("news")); }; destination df_news_dot_err { file("/var/log/news/news.err" owner("news")); }; destination df_news_dot_crit { file("/var/log/news/news.crit" owner("news")); }; # some more classical and useful files found in standard syslog configurations destination df_debug { file("/var/log/debug"); }; destination df_messages { file("/var/log/messages"); }; # pipes # a console to view log messages under X destination dp_xconsole { pipe("/dev/xconsole"); }; # consoles # this will send messages to everyone logged in destination du_all { usertty("*"); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs VALUES('$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG');\n") template-escape(yes)); }; log {source; destination(d_mysql); }; ###### # filters # all messages from the auth and authpriv facilities filter f_auth { facility(auth, authpriv); }; # all messages except from the auth and authpriv facilities filter f_syslog { not facility(auth, authpriv); }; # respectively: messages from the cron, daemon, kern, lpr, mail, news, user, # and uucp facilities filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; # some filters to select messages of priority greater or equal to info, warn, # and err # (equivalents of syslogd's *.info, *.warn, and *.err) filter f_at_least_info { level(info..emerg); }; filter f_at_least_notice { level(notice..emerg); }; filter f_at_least_warn { level(warn..emerg); }; filter f_at_least_err { level(err..emerg); }; filter f_at_least_crit { level(crit..emerg); }; # all messages of priority debug not coming from the auth, authpriv, news, and # mail facilities filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; # all messages of info, notice, or warn priority not coming form the auth, # authpriv, cron, daemon, mail, and news facilities filter f_messages { level(info,notice,warn) and not facility(auth,authpriv,cron,daemon,mail,news); }; # messages with priority emerg filter f_emerg { level(emerg); }; # complex filter for messages usually sent to the xconsole filter f_xconsole { facility(daemon,mail) or level(debug,info,notice,warn) or (facility(news) and level(crit,err,notice)); }; ###### # logs # order matters if you use "flags(final);" to mark the end of processing in a # "log" statement # these rules provide the same behavior as the commented original syslogd rules # auth,authpriv.* /var/log/auth.log log { source(s_all); filter(f_auth); destination(df_auth); }; # *.*;auth,authpriv.none -/var/log/syslog log { source(s_all); filter(f_syslog); destination(df_syslog); }; # this is commented out in the default syslog.conf # cron.* /var/log/cron.log #log { # source(s_all); # filter(f_cron); # destination(df_cron); #}; # daemon.* -/var/log/daemon.log log { source(s_all); filter(f_daemon); destination(df_daemon); }; # kern.* -/var/log/kern.log log { source(s_all); filter(f_kern); destination(df_kern); }; # lpr.* -/var/log/lpr.log log { source(s_all); filter(f_lpr); destination(df_lpr); }; # mail.* -/var/log/mail.log log { source(s_all); filter(f_mail); destination(df_mail); }; # user.* -/var/log/user.log log { source(s_all); filter(f_user); destination(df_user); }; # uucp.* /var/log/uucp.log log { source(s_all); filter(f_uucp); destination(df_uucp); }; # mail.info -/var/log/mail.info log { source(s_all); filter(f_mail); filter(f_at_least_info); destination(df_facility_dot_info); }; # mail.warn -/var/log/mail.warn log { source(s_all); filter(f_mail); filter(f_at_least_warn); destination(df_facility_dot_warn); }; # mail.err /var/log/mail.err log { source(s_all); filter(f_mail); filter(f_at_least_err); destination(df_facility_dot_err); }; # news.crit /var/log/news/news.crit log { source(s_all); filter(f_news); filter(f_at_least_crit); destination(df_news_dot_crit); }; # news.err /var/log/news/news.err log { source(s_all); filter(f_news); filter(f_at_least_err); destination(df_news_dot_err); }; # news.notice /var/log/news/news.notice log { source(s_all); filter(f_news); filter(f_at_least_notice); destination(df_news_dot_notice); }; # *.=debug;\ # auth,authpriv.none;\ # news.none;mail.none -/var/log/debug log { source(s_all); filter(f_debug); destination(df_debug); }; # *.=info;*.=notice;*.=warn;\ # auth,authpriv.none;\ # cron,daemon.none;\ # mail,news.none -/var/log/messages log { source(s_all); filter(f_messages); destination(df_messages); }; # *.emerg * log { source(s_all); filter(f_emerg); destination(du_all); }; # daemon.*;mail.*;\ # news.crit;news.err;news.notice;\ # *.=debug;*.=info;\ # *.=notice;*.=warn |/dev/xconsole log { source(s_all); filter(f_xconsole); destination(dp_xconsole); }; iam running on Debain Sarge AMD64bit any idea whats wrong? -- Colin O'Keeffe

2 1

Re: [syslog-ng] Program Filters
by Metal Gear 27 May '05

27 May '05

Still there are no compilation errors now but i m not having any logs of ftp and ssh when i remove filters then i get the bunch of logs. Setting the filters for facility(auth, authpriv) is working but it gives only the users who are successfully connected theu ssh or ftp. I m sending my syslog-ng.conf using filters but i m not getting the logs of it. source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; source stunnel {tcp(ip("127.0.0.1 <http://127.0.0.1>") port(514) keep-alive(yes));}; filter f_ftp {program(".*ftp*.");}; filter f_ssh {program(".*ssh*.");}; log {source(src); filter(f_syslog); filter(f_ftp); filter(f_ssh); destination(dest2);}; log {source(stunnel); filter(f_syslog); filter(f_ftp); filter(f_ssh); destination(dest2);}; Thanks

2 1

Get "warning: ignoring #pragma" warnings when compiling libol-0.3.16 on HP-UX
by Jenny-Lou Sequeira 27 May '05

27 May '05

If I just run #./configure CC=gcc CFLAGS="-v #make It compiles fine. Looking at the log from make the include path is: . /usr/local/include /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include /usr/include However, if I restrict the "Include" path to the following ./configure CC=gcc CFLAGS="-v -nostdinc -O2" CPPFLAGS="-I/usr/local/include -I/usr/local/lib/gc/ia64-hphpux11.23/3.4.3/include -I/usr/include" "make" spews out warnings like: /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include/stdlib.h:30: warning: ignorin g #pragma builtin_milli abs /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include/stdlib.h:31: warning: ignorin g #pragma extern abs /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include/stdlib.h:65: warning: ignorin g #pragma builtin_milli div /usr/include/sys/signal.h:174: warning: ignoring #pragma extern signal /usr/include/sys/signal.h:191: warning: ignoring #pragma extern kill /usr/include/sys/signal.h:192: warning: ignoring #pragma extern sigismember /usr/include/sys/signal.h:193: warning: ignoring #pragma extern sigpending Thanks, Jenny-Lou

1 0

SV: [syslog-ng] syslog-ng 1.6.8 has been released
by kenneth.gullberg＠foreningssparbanken.se 26 May '05

26 May '05

Hi, Here is a small suggestion for the INSTALL file in the next release for unexperienced admin's: Solaris 10 ---------- For successful compilation on Solaris 10 you need to use --enable-full-dynamic when you run configure. // Kenneth -----Ursprungligt meddelande----- Från: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] För Balazs Scheidler Skickat: den 26 maj 2005 10:46 Till: syslog-ng(a)lists.balabit.hu Kopia: syslog-ng-announce(a)lists.balabit.hu Ämne: [syslog-ng] syslog-ng 1.6.8 has been released Hi, I have released syslog-ng 1.6.8 containing some configure tweaks, a 64bit compatibility fix and a use_fqdn() fix when getting local hostnames. The NEWS entry is below: News for the 1.6.8 release Thu, 26 May 2005 10:24:33 +0200 * Some configure tweaking to detect proper ld options dynamically on Linux, Solaris and HP-UX. Other platforms might still have problems with static linking. * Some minor manpage fixes. * Use use_fqdn() option when determining local hostname instead of directly using the possibly short hostname returned by gethostname(). * Fixed a 64 bit compatibility issue when resolving hostnames. The release can be found at the usual place: http://www.balabit.com/products/syslog-ng/upgrades.bbq -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng 1.6.8 has been released
by Balazs Scheidler 26 May '05

26 May '05

Hi, I have released syslog-ng 1.6.8 containing some configure tweaks, a 64bit compatibility fix and a use_fqdn() fix when getting local hostnames. The NEWS entry is below: News for the 1.6.8 release Thu, 26 May 2005 10:24:33 +0200 * Some configure tweaking to detect proper ld options dynamically on Linux, Solaris and HP-UX. Other platforms might still have problems with static linking. * Some minor manpage fixes. * Use use_fqdn() option when determining local hostname instead of directly using the possibly short hostname returned by gethostname(). * Fixed a 64 bit compatibility issue when resolving hostnames. The release can be found at the usual place: http://www.balabit.com/products/syslog-ng/upgrades.bbq -- Bazsi

1 0

host$
by Speedy Sweedy 26 May '05

26 May '05

I am new to this list and new to syslog-ng so please forgive me if this question has been asked before. I looked through the archive but didn't come across anything that helped me. I have syslog-ng working on my FC3 box with SELinux set at its highest setting(wow that was fun!) but it logs the IP address of the remote host instead of the hostname. I can't seem to get it to log anything different than the IP address of the box sending the log. Here is my options in syslog-ng.conf: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; what am I doing wrong? Regards, The Speedster _________________________________________________________________ MSN® Calendar keeps you organized and takes the effort out of scheduling get-togethers. http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*.

3 4