- syslog-ng - lists.balabit.hu

accept syslog from remote hosts ?
by ip.guy 13 Apr '05

13 Apr '05

hi all how does one allow remote syslog (not syslog-ng) servers currently logging to the syslog on the central log server (running vanilla syslog) access to dump syslog entires into syslog-ng when started ? if i tail /var/log/messages when syslog-ng is running and syslog is stopped, i can see local messages but nothing from remote hosts which are setup to log to the host. see below re my syslog-ng conf file. options { long_hostnames(off); sync(0); stats(43200); dns_cache(yes); use_fqdn(no); keep_hostname(yes); use_dns(yes); }; source shell { internal(); unix-stream("/dev/log"); tcp(ip(192.49.109.241) port(514) max-connections(300)); }; destination localhost { file("/var/log/messages"); }; log { source(shell); destination(localhost); };

2 1

Syslog-ng test suite
by Jenny-Lou Sequeira 13 Apr '05

13 Apr '05

Is there any test suite available for syslog-ng? Thanks, Jenny-Lou

1 0

syslog-ng 1.6.7 has been released
by Balazs Scheidler 13 Apr '05

13 Apr '05

Hi, I have incorporated the latest spoof-source specific changes and released a new stable version with the following NEWS entry: News for the 1.6.7 release Sat, 09 Apr 2005 12:46:51 +0200 * Fixed a memory leak and possible fd leak in spoof-source support. * Fixed destination port byte order on little-endian machines, triggered when a non-514 port was used. * Added fedora-core specific packaging files. I have updated the download page which is available at this URL: http://www.balabit.hu/products/syslog-ng/upgrades.bbq Happy logging, -- Bazsi

2 1

how to pass a value from an expanded macro to an external program?
by Andrew_Hilton＠ElementK.com 12 Apr '05

12 Apr '05

I am attempting to mail log alerts for failed attempts by root through sshd. I have various boxes logging remotely (through their native syslogd) to a central log server running syslog-ng 1.6.6 (on redhat ES3.0). I have the following in my syslog-ng conf specific to ssh: # i know this catches all, and not just root filter f_ssh_login_attempt { program("sshd.*") and match("(Failed)") and not match("Accepted"); }; destination d_mail-alert { program("/usr/local/bin/syslog-mail $HOST $PROGRAM"); }; log { source (s_udp); filter(f_ssh_login_attempt); destination(d_mail-alert); }; I was hoping to be able to pass the $HOST (or other macros) to the script, but this doesn't seem to work? the script is nothing more then a shell script which attempts to use $1 $2 in the subject line of the mail message. the script does generate an email with the syslog message in the body, but $1 and $2 are empty. how do I pass a value from an expanded macro to an external program? I will be installing swatch at some point, but since I already had syslog-ng running... thanks

3 5

match to an empty messages line
by Stephan Hendl 12 Apr '05

12 Apr '05

Hi all, recently I included fibrechannel switches in my central syslog-ng. The switches often send empty line among important lines. I want to drop the empty ones. How can I achieve that by means of filter rules? Stephan

2 1

1.6.7 on AIX/GCC
by Gehring, Andrew x66132 12 Apr '05

12 Apr '05

I'm trying to compile syslog-ng 1.6.7 on AIX 5.3 with GCC 3.3.2 Successfully compiled, and installed (/usr/local) libol 0.3.14 ./configure --with-libol=/usr/local and I get the following: checking libol version >= 0.3.14... configure: error: libol-config not found in the specified location libol-config is in /usr/local/bin, and /usr/local/bin is in the $PATH. If I set --with-libol=/usr/local/bin, then it doesn't find libol.h. II've set LDFLAGS and CPPFLAGS, also to no avail.. Thanks for any guidance... Andrew _ This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

2 1

Lots of warnings.........
by Metal Gear 12 Apr '05

12 Apr '05

Hi all, When i type http://localhost/syslog/index.php in my browser the following errors comes up. Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /www/htdocs/web/index.php on line 35 Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /www/htdocs/web/index.php on line 53 All logs from syslog-ng are logged to mysql (database syslog and table logs). I have defined in db_fns.php $result = mysql_pconnect("", "", ""); becauz when i write mysql on shll in connects directly. Could someone can help me... thanks

1 0

problem with syslog-ng
by niraj 08 Apr '05

08 Apr '05

I m facing problem with this code . When I execute this program it forks 2 process A zombie syslog-ng process on the forked ID syslog-ng on the next pid but without while loop every thing is working properly TIA niraj #include<iostream> #include<unistd.h> using namespace std; int main() { int cpid; cpid=fork(); if(cpid==0) { if(execv( "/usr/local/sbin/syslog-ng" ,NULL)==-1) { cout<<"hello"<<endl; } cout<<"ok"<<endl; } while(1) { ; } return 0; } ~ ~

3 3

Syslog-ng 1.6.6 Redhat ES 3.0 - too many open files
by henry＠shoelacecity.com 08 Apr '05

08 Apr '05

I've sucessfully beaten down the memory leak issues I've been experiencing thanks to Balazs suggested patches. I am now experiencing a different sort of "leak". I worked back from the log files to identify the problem, but not the cause. I restart syslog-ng weekly. Towards the end of each week, I notice log messages: syslog-ng[15710]: STATS: dropped 12828 syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) A quick "lsof -c syslog-ng" revealed a few hundred open files. I restarted syslog-ng and checked for open files - the number was about 25. In the past hour of monitoring, that number has jumped to over 70. The "files" that appear to be increasing are these (from the output of lsof) : syslog-ng 17081 root 61u raw 51703353 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 62u raw 51711769 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 63u raw 51721047 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 64u raw 51727149 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 65u raw 51738764 00000000:00FF->00000000:0000 st=07 My syslog-ng.conf specifies only 4 real log file to write to, and one pipe(for mysql writing), and two UDP destinations (spoof enabled). CPU utilization on the machine is less than 5%, and there's plenty of free memory. Any thoughts? I'd hate to have to restart syslog-ng daily.

3 8

central logging host - failback
by truth99＠gmx.net 08 Apr '05

08 Apr '05

Hello, we have some servers that send there logs to an central logging server - my question: is there any fallback-solution if the central logging server is not reachable? The "client" server are ramdisk systems with no space for local-logging. Best Regards, Oliver -- Was ist das denn? Das sind Beschleunigungslöcher, die machen den Computer schneller. ( Frei nach Homer J. Simpson ) Handyrechnung zu hoch? Tipp: SMS und MMS mit GMX Seien Sie so frei: Alle Infos unter http://www.gmx.net/de/go/freesms

2 2