- syslog-ng - lists.balabit.hu

Multi-line log entries
by yesenia_rincon＠bankone.com 04 May '05

04 May '05

Are you aware of any issues where on the local host the multi-line messages include the hostname and syslog-ng does not include the hostname, is there a configuration option to resolve this problem ? Apr 23 00:00:05 img4s012.svr.bankone.net/img4s012.svr.bankone.net scsi: [ID 107833 kern.warning] WARNING: /pci@8,700000/pci@2/ lpfc@5/sd@0,de (sd98): Apr 23 00:00:05 img4s012.svr.bankone.net/img4s012.svr.bankone.net corrupt label - wrong magic number This is how the event shows in syslog-ng: Apr 23 00:00:05 img4s012.svr.bankone.net/img4s012.svr.bankone.net scsi: [ID 107833 kern.warning] WARNING: /pci@8,700000/pci@2/ lpfc@5/sd@0,de (sd98): Apr 23 00:00:05 corrupt label - wrong magic number Regards, Jessie This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you.

2 1

Shiming Yang/OCIO_CorpDataSecurity/Planning_Office/HQ_for_the_Americas/BTMNA is out of the office.
by Shiming Yang 04 May '05

04 May '05

I will be out of the office starting 05/03/2005 and will not return until 05/05/2005. I will respond to your message when I return. If there is problem about Proxy or IBM web hosting facility, please call my backup Will at 8380. ----------------------------------------- The information contained in this electronic mail message, and any and all accompanying documents, constitutes confidential information. If you are not the intended recipient of this information, any disclosure, copying, distribution, or the taking of any action in reliance on it is strictly prohibited. If you received this information in error, please notify the sender immediately and destroy this communication. Messages sent via this medium may be subject to delays and/or unauthorized alteration. Neither The Bank of Tokyo-Mitsubishi, Ltd. nor any of its affiliates shall be held liable for the contents of this message.

1 0

a weird configuration
by Julio Kriger 04 May '05

04 May '05

Hi! I a need to setup a weird configuration of syslog-ng and I don't know how to do it. Please help me!!! So, here is my problem. I have 2 programs, say A and B. I have metalog configure so that program A write logs a file called log_A, and program B write logs to log_B. This is the easy part. Now the real problem. I have a kernel module K that is used by both programs that also write some logs. I want that the logs written by kernel module K when used by program A go to log_A file. The same with program B, logs should go log_B. How can I do this? TIA. Regards, Julio -- ------------------------ Julio Kriger mailto:julio@cwazy.co.uk

2 7

Cisco formatting
by Erwin Middelberg 04 May '05

04 May '05

Hi All, I'm rather new to syslog-ng and have a question I couldn't find answers for, searching on the web. We're using syslog-ng (1.5.15) as a central relay server for several Cisco devices, were the devices sent their syslogs to the syslog-ng server and syslog-ng forwards them to my Netcool monitoring environment. A problem I'm running into, is that some Cisco messages contain carriage returns, splitting one message over 2 or more lines. I could do some tricks on the Netcool side, but it would be much cleaner if I could filter those CR's within syslog-ng. Is this possible ? TIA, Erwin

1 0

Re: Re: [syslog-ng]a weird configuration
by jbrunke＠ctsgi.com 04 May '05

04 May '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

1 0

Possible segmentation fault in syslog-ng
by Balazs Scheidler 03 May '05

03 May '05

Hi, I have finally been able to track down a nasty segmentation fault/abort problem. The fix can be found in libol 0.3.16, which is statically linked into syslog-ng. Therefore to grab the fix, you need to recompile syslog-ng with the new libol. The problem occurs when: * internal() messages were directed to a file which had a name with macros in it * you had one or more TCP sources which close their connections from time to time (Kiwi syslogd is such a program) * the volume of the log messages is very low in this destination, in fact it might be required that nothing else but TCP connection close messages are received here, and less often than the interval time_reap() specifies. How to reproduce: * Use the following configuration: options { time_reap(1); gc_idle_threshold(1); }; source src { unix-stream("log"); internal(); }; source net { tcp(port(2000)); }; destination d_local { file("logs/messages.$YEAR.$HOST.$DAY"); }; destination d_net { file("logs/net.log"); }; log { source(src); destination(d_local); }; log { source(net); destination(d_net); }; * Create the directory containing the log files "logs" * Start syslog-ng * Connect to port 2000 using telnet, wait somewhat more than 1 second * Wait while garbage collection starts (should be immediately as gc_idle_threshold() is set to 1) Syslog-ng will crash with Segmentation fault or an Abort. Thanks go to Janos Lajos who has reported and helped me to track down the issue. Libol 0.3.16 is available at: http://www.balabit.hu/downloads/syslog-ng/libol/0.3/libol-0.3.16.tar.gz PGP signature: http://www.balabit.hu/downloads/syslog-ng/libol/0.3/libol-0.3.16.tar.gz.asc -- Bazsi

1 0

RE: [syslog-ng]RE: Recommended windows event logger products to work with syslog-ng
by SOLIS, ALEX 03 May '05

03 May '05

I don't think you did anything wrong. When I installed my ntsyslog, it worked fine. You might want to try ntsyslog in debug mode. You can do this by running ntsyslog -debug at the command line. This will show what is being sent over the wire on your console. If your time-stamps are missing during the debug output then ntsyslog might be parsing incorrectly. If they show in the debug output but are missing at the syslog-ng server, then maybe the syslog-ng config should be looked at. There are patches available at the sourceforge project site. I believe one of them is specifically designed to fix "incomplete messages"; Its worth a try if you are out of ideas but like I said before, I did not experience missing timestamps when I deployed. In my experience with NTsyslog, most messages fit in the message buffer ntsyslog sets aside for transmission. I believe the buffer size is set around 1024 so it should accommodate most WinNT eventlog messages. Good luck troubleshooting! Alex -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Shane Presley Sent: Monday, May 02, 2005 8:41 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]RE: Recommended windows event logger products to work with syslog-ng I installed nt-syslog (http://ntsyslog.sorceforge.net) but it seems the messages coming from it do not contain the date/time field? Is that just somethind I did wrong? Also, in general, with these EventLog -> Syslog products, do they capture the entire event log message? For example the sometimes verbose "Description" field? Thanks Shane On 4/21/05, SOLIS, ALEX <asolis(a)oppd.com> wrote: > > I use nt-syslog (http://ntsyslog.sorceforge.net) It seems to work fine although I too get corrupt event logs on the windows boxes every now and then. I am not 100 percent convinced that it is caused by nt-syslog but it seems to be a posibility. > > Alex _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

1 0

RE: [syslog-ng]Issues with HP-UX
by Stephen Tanner 03 May '05

03 May '05

This does not work. Syslog-ng still does not log anything. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Stephan Hendl Sent: Tuesday, May 03, 2005 7:59 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Issues with HP-UX your source should look the following source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; the pad_size ist very important. BTW, it is included in the doku as well as in the faq I think. regards Stephan >>> stanner(a)leeclerk.org 05/02/05 9:23 >>> I have recently started using syslog-ng so that I can use stunnel to log to a central loghost. I have gotten syslog-ng working on a linux box, and everything works fine, but my HP-UX boxes won't even log locally, much less log to a loghost. Below, I have included the syslog-ng.conf for one of the hosts. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= options { use_fqdn(no); keep_hostname(no); use_dns(no); long_hostnames(off); sync(3); log_fifo_size(300); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # source src { unix-dgram("/dev/log.un"); internal(); }; # After that set destinations. # First some standard logfile # destination lpr { file("/var/adm/lpr.log"); }; destination mail { file("/var/adm/mail.log"); }; # Some `catch-all' logfiles. # destination syslog { file("/var/adm/syslog/syslog.log"); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { level(info .. warn)and not facility(auth, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; ############################################################### log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_messages); destination(syslog); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); destination(messages); }; ############################################################### ## set up logging to a loghost forwarded from localhost via stunnel destination loghost {tcp("127.0.0.1" port(514));}; # send everything to loghost, too log { source(src); destination(loghost); }; ############################################################### _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng 1.6.7 on solaris10
by kenneth.gullberg＠foreningssparbanken.se 03 May '05

03 May '05

Im having some compilation issues with Solaris 10: bash-3.00# ./configure --disable-tcp-wrapper --disable-spoof-source -- snip-- checking for TCP wrapper library... -lwrap checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking for pthread_create in -lpthread... yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... no checking libol version >= 0.3.14... ok configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating src/tests/Makefile config.status: creating doc/Makefile config.status: creating doc/sgml/Makefile config.status: creating contrib/Makefile config.status: creating syslog-ng.spec config.status: creating src/config.h config.status: executing depfiles commands bash-3.00# which make /usr/ccs/bin/make gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lpthread -lnsl -lsocket -ldoor -lresolv /usr/local/lib/libol.a -lsocket -lnsl -lxnet -Wl,-Bstatic -ll -lwrap -Wl,-Bdynamic ld: fatal: library -ll: not found ld: fatal: library -lwrap: not found ld: fatal: File processing errors. No output written to syslog-ng if i change where -ll and -lwrap is located on the line to: bash-3.00# gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lpthread -lnsl -lsocket -ldoor -lresolv -ll -lwrap /usr/local/lib/libol.a -lsocket -lnsl -lxnet -Wl,-Bstatic -Wl,-Bdynamic I instead get: Undefined first referenced symbol in file deny_severity /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/../../../libwrap.so allow_severity /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/../../../libwrap.so ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status I got around that with editing config.h and changed the TCP wrapper lib line to: #undef ENABLE_TCP_WRAPPER and fiddled around in the src/tests Makefile and .c file Perhaps something missing in the configure scripts?

2 1

Re: Re: [syslog-ng]Issues with HP-UX
by jbrunke＠ctsgi.com 03 May '05

03 May '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

1 0